NetWare 4 admin trouble.

[GlobalBrain]

Somebody ask me for help. They have small NetWare 4.11 network (35 machines and about 40 users). Some kids managed to get in as administrator (yes it’s a small school), now all users with administrator rights can’t do any admin tasks. When they open NetWare Admin all functions are grey. And kids have changed password for administrator account. (Normally in NetWare Admin if people don’t have rights to create or change something, all functions are normal (not grey!!!), it just tells you that you don’t have rights to do it.)
Does anybody know what they did and how to fix this?
Thanks.

 

[cmptrnerd]

contact Novell they have a utility that will reset admin password. Mark
cmptrnerd@core.com

 

[Lou0686]

Hi,

Before calling Novell, you may have a backdoor on the server. It's really not a backdoor but you may have a user that was created with admin equivalency for the purpose of Backups or some other reason. Try loggin in as that user(s) and attempt to change the adin password.

Lou

 

[spi200]

Hi

If they got that far they will have given themselves full rights to the Server. You will need to do a scan of all users otherwise they will change your password again. !!!
Tell your friend to lock them down and regain controll of the server before they cause real harm.
I believe there is a utility to crack novell passsword's which is run from the server (NLM). I used it once, but can not remember its name. You will find it on the web.


Regards

David CNE

 

[spi200]

Hi Again

The Utility is called SETPWD.NLM and is run at the console. Do a search on google.com.au for "novell" and "hack" and "password" and "crack" should get you there.

Regards

David

 

[GlobalBrain]

Thanks for your help.
I have managed to get Administrators password (found really "interesting" tools on the internet, if somebody with this tools have access to consol on Netware 4 system, this system is not secure!!!). But all functions in NetwareAdmin for Administrator are grey too!!! And some kids have passwords over 30 characters long.
So, I'm still nowhere. It's very difficult when I can't get to that system phisically.

But I have found the way this kids managed to get in:
After the person with admin rights logged off they went to that machine and canselled the login screen. When in Windows (98), they right clicked on "N" (by the clock) and selected "login". When login screen pops up they right clicked on the login screen and selected "undo", this command brought last persons login name and password. They only needed to click "OK"!!! Obviously, system doesn't have great security implemented. Be aware and check your system!!!

Please keep the ideas coming. I still need to help this guys.