---------------------------------------------------------------------------

Section 00

General Info

---------------------------------------------------------------------------

00-1. What is this "FAQ" for?

This FAQ serves two distinct purposes -- the first is to provide the NT
hacker with a resource. The second purpose is a wake-up call to Sys Admins
who are too lazy to install the latest Service Pack.

This FAQ assumes basic knowledge of NT. If you do not know the basics, go
buy a book or take one of those overpriced classes I get junk mail about.
Do not send me email asking me questions that can be answered with basic
knowledge -- I don't acknowledge them, I delete them.

---------------------------------------------------------------------------

00-2. What is the origin of this FAQ and how do I add to it?

This FAQ started for two reasons. First, several people asked if I was 
going to do one. This seems reason enough, but the clincher was reading a
partial quote from the NT Security FAQ, which stated in the Legaleeze
section that the FAQ was not "a cookbook to be used by crackers to gain 
access to Windows NT systems." Well, that's hardly fun, now is it! (BTW
the NT Security FAQ is still an excellent resource.)

I've been collecting info and reading about NT, but once I got to load up
NT in my lab things really got moving. 

To add info to this FAQ, simply send an email to faq@nmrc.org with "NT"
in the subject. Please let me know what steps can duplicate an exploit,
any patches or workarounds that might fix it, whether Microsoft knows or
cares about it, and if you want to be credited in the FAQ.

Anonymous submissions are okay. Encrypt them if you like, here's my PGP
key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzEQrjMAAAEEANaIf2AiInhVwmrZEFZ5V2eyZfuJfjoI9unJwRhokwJ4TtVh
ApEwjXVEbJBCPRKOHzibi5IEF2BirpzzlSy0Aj82yZk/iqYtJO60S0aycSPNPBl5
BmoLJaUjxakmnMMXOl3qdeWWtScpP7B4QTHyfsHRvQz0HSUPxh6RUqAiTzdxAAUR
tCRTaW1wbGUgTm9tYWQgPHRoZWdub21lQGZhc3RsYW5lLm5ldD4=
=v0Xj
-----END PGP PUBLIC KEY BLOCK-----

---------------------------------------------------------------------------

00-3. Is this FAQ available by anonymous FTP or WWW?

The FAQ is available as text or HTML from the following location:

 - http://www.nmrc.org/files/nt

Entire FAQ online:

 - http://www.nmrc.org/faqs/nt

---------------------------------------------------------------------------

00-4. How was this FAQ prepared?

After collecting information from a number of sources, I loaded NT Server
4.0 and performed a number of the techniques discussed in this FAQ. Most of
the tests involved Samba. Tests were conducted at the NMRC labs, on a
friend's network, and at a client's site (yes they gave me permission).

The tests were not THAT scientific -- most involved duplicating the many
bugs that people have reported and playing with the various NT hacking
tools that are starting to appear. I've also tried to document some of the
major components that make up NT, especially if they are related to
security.

---------------------------------------------------------------------------
