From: Thor (Hammer of God) (thor@hammerofgod.com)
Date: Sat Jun 23 2007 - 13:23:09 EDT
----- Original Message -----
From: "Bojan Zdrnja" <bojan.zdrnja@gmail.com>
To: "Thor (Hammer of God)" <thor@hammerofgod.com>
Cc: <pen-test@securityfocus.com>
Sent: Saturday, June 23, 2007 12:19 AM
Subject: Re: Re: Strange ports
> On 6/23/07, Thor (Hammer of God) <thor@hammerofgod.com> wrote:
>> If you use Exchange (well, specifically, if Exchange is doing the DNS
>> lookup) then you do need TCP 53 as Exchange SMTP (or IIS SMTP) uses TCP
>> by
>> default for DNS queries. This is actually a good thing, as it is easier
>> to
>
> TCP by default?
Yes, TCP by default for SMTP DNS queries. See
http://support.microsoft.com/kb/263237 (that's a ex2k kb, but it still
applies)
> So you are saying that Exchange doesn't use system's
> resolver but instead has an internal one?
> This is pretty interesting, can you point to Microsoft's documentation
> about this?
Indeed - Exchange uses a separate DNS configuration for host resolution of
SMTP destinations (when configured). When you consider the heavy requirement
for Exchange to be integrated with Active Directory, you identify the fact
that the "local" IP stack has to point to internal AD DNS to function
properly. Therefore, Exchange allows you to set DNS settings specifically
for the SMTP virtual server's use if it can't resolve hosts via your
internal DNS design-- like when you have root zones in your AD or you've
isolated internal DNS without forwarders.
You go the the properties of an SMTP virtual server, go to the Delivery tab,
click Advanced, and then click Configure to configure external DNS servers
separate from the local stack. If this option is not configured, then
standard DNS settings of the adapter stack are used, but resolution is still
TCP by default.
HTH
t
-------------
Veni, vidi, veni denuo.
Check out Thor's "Microsoft Ninjitsu: Blackbelt Edition" training at
Blackhat Vegas!
http://www.blackhat.com/html/bh-usa-07/train-bh-us-07-tm-ms-bbe.html
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:54 EDT