Get users domain login name oddities

[lmayer4]

Afternoon,

I have two scripts, that TRY to pull the current users domain login name from the computer, that work sporadically and not on every computer:

exec("nbtstat -A ".$REMOTE_ADDR,$retour);
for($i = 0 ; $i <= sizeOf($retour); $i++){
if (strchr($retour[$i],"<03>")){
$tab = explode(" ",$retour[$i]);

for ($j=0;$j<= sizeof($tab);$j++){
if ($tab[$j] != ""){
$Mot[] = $tab[$j];
break; }else{
continue; }
}
}
}

$hote = gethostbyaddr($REMOTE_ADDR);
$NomMachine = explode(".",$hote);

for ($i=0; $i <= sizeOf($Mot); $i++){
if (strtolower($Mot[$i]) != strtolower($NomMachine[0])){
$Final[] = $Mot[$i];
}
}

$result = array_unique ($Final); 
echo $result[1];

and the other one:

error_reporting(0);
   /* get the ip of the client */
    if (isset($_SERVER["HTTP_X_FORWARDED_FOR"]))
        {
        $ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
        }
    else 
        {
        $ip = $_SERVER["REMOTE_ADDR"]; 
        }

   /* send a "special" packet */
   $fp = fsockopen('udp://'.$ip, 137);
   fwrite($fp, "\x80b\0\0\0\1\0\0\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\1");
   /* wait 2 secs, and get the data */
   socket_set_timeout($fp, 2);
   $data = fread($fp, 256);


   /* get netbios records number */
   $nbrec = ord($data[56]);

   /* display nebios records : the username is a record of type 3 */
   for($i = 0; $i < $nbrec; $i++) 
       {
            $offset = 18 * $i;
    if (ord($data[72 + $offset]) == 3)
           {
              $userid = trim(substr($data, 57 + $offset, 15));
           }     

        }

$result = str_replace('$','',$userid);

Does any one have any scripts that work all the time? Or close to all the time?

Thanks in advance.

Laura

[leatherback]

I may certainly hope not!

I'd see this as quite a security risk, if I were a network administrator!

J.

[LoganK]

I agree....I don't know what in the world this script is doing, but from the looks of it, it looks like it's opening a connection to UDP port 137 and trying to execute a buffer overflow attack (port 137 [Netbios] on Windows computers can be used to find out open shares on the machine which can then be exploited, like IPC$).

[lmayer4]

You're right that's exactly what they do.

It's used for single sign-on in an intranet. Turns out the culprit, or in your minds the savior, is SP2 for windows XP. The increased security stops any of this from working.

I'll have to rewrite it to talk to LDAP and have the user log in to use the application.