:: Enumerate all listening services
netstat -an | find "LISTENING" > listening_ports.txt

:: Common vulnerable ports on Windows 2000
:: 135 - RPC Endpoint Mapper
:: 139 - NetBIOS Session Service
:: 445 - SMB/CIFS
:: 1433 - SQL Server
:: 3389 - Terminal Services (RDP)

:: Check for exposed services
nmap -sV -p 1-65535 localhost > service_scan.txt

:: List all network shares
net share > network_shares.txt

:: Check null session vulnerability
net use \\localhost\IPC$ "" /user:"" > null_session_test.txt

#!/usr/bin/env python
# Windows 2000 Network Vulnerability Scanner
# Requires Python 2.x for Win2000 compatibility

import socket
import struct

vulnerable_ports = {
    135: "RPC Endpoint Mapper - Critical",
    139: "NetBIOS - High Risk",
    445: "SMB - Critical (EternalBlue)",
    1433: "SQL Server - High Risk",
    3389: "RDP - Medium Risk",
    80: "IIS 5.0 - High Risk",
    21: "FTP - Medium Risk",
    23: "Telnet - Critical"
}

def scan_port(host, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(1)
    result = sock.connect_ex((host, port))
    sock.close()
    return result == 0

def assess_vulnerability(host):
    print "Scanning %s for vulnerable services..." % host
    for port, service in vulnerable_ports.items():
        if scan_port(host, port):
            print "[VULNERABLE] Port %d open - %s" % (port, service)

if __name__ == "__main__":
    assess_vulnerability("127.0.0.1")

Completely Isolated Network Design:
┌─────────────────┐
│ Internet        │
└────────┬────────┘
         │
    ┌────▼────┐
    │ Firewall │
    └────┬────┘
         │
    ┌────▼────────┐
    │ Corporate   │
    │ Network      │
    └──────┬──────┘
           │
      NO CONNECTION
           │
    ┌──────▼──────┐
    │ Win2000      │
    │ Isolated     │
    │ Network      │
    └─────────────┘

! Cisco IOS VLAN configuration for Win2000 isolation

! Create isolated VLAN for Windows 2000
vlan 666
 name WIN2000_QUARANTINE
 state active

! Configure access port
interface GigabitEthernet0/1
 description Win2000 Server - ISOLATED
 switchport mode access
 switchport access vlan 666
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation shutdown
 storm-control broadcast level 1.00
 storm-control multicast level 1.00
 spanning-tree portfast
 spanning-tree bpduguard enable

! Restrict inter-VLAN routing
interface Vlan666
 description Win2000 Quarantine Network
 ip address 192.168.66.1 255.255.255.0
 no ip proxy-arp
 no ip redirects
 no ip unreachables

! Strict ACL for Windows 2000 VLAN

ip access-list extended WIN2000_ISOLATION
 ! Deny all inbound by default
 deny ip any any log

 ! Allow specific management access only
 permit tcp host 10.0.0.10 192.168.66.0 0.0.0.255 eq 3389 log

 ! Allow internal DNS only
 permit udp 192.168.66.0 0.0.0.255 host 10.0.0.53 eq 53

 ! Allow internal time sync
 permit udp 192.168.66.0 0.0.0.255 host 10.0.0.123 eq 123

 ! Deny all other traffic
 deny ip any any log

! Apply to VLAN interface
interface Vlan666
 ip access-group WIN2000_ISOLATION in
 ip access-group WIN2000_ISOLATION out

:: Create IPSec policy for network isolation
:: Note: Limited compared to modern firewalls

:: Create IPSec policy
netsh ipsec static add policy name="Win2000_Isolation"

:: Add filter list for blocked traffic
netsh ipsec static add filterlist name="Block_Dangerous"

:: Block SMB
netsh ipsec static add filter filterlist="Block_Dangerous" ^
  srcaddr=any dstaddr=me protocol=tcp srcport=0 dstport=445

:: Block NetBIOS
netsh ipsec static add filter filterlist="Block_Dangerous" ^
  srcaddr=any dstaddr=me protocol=tcp srcport=0 dstport=139

:: Block RPC
netsh ipsec static add filter filterlist="Block_Dangerous" ^
  srcaddr=any dstaddr=me protocol=tcp srcport=0 dstport=135

:: Create filter action
netsh ipsec static add filteraction name="Block" action=block

:: Create rule
netsh ipsec static add rule name="Block_Dangerous_Ports" ^
  policy="Win2000_Isolation" filterlist="Block_Dangerous" ^
  filteraction="Block"

:: Assign policy
netsh ipsec static set policy name="Win2000_Isolation" assign=yes

# iptables rules for Linux firewall protecting Win2000

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Windows 2000 specific rules
# Allow only internal management
iptables -A FORWARD -s 10.0.0.10/32 -d 192.168.66.0/24 -p tcp --dport 3389 -j ACCEPT

# Block all SMB/NetBIOS
iptables -A FORWARD -p tcp --dport 135:139 -j DROP
iptables -A FORWARD -p tcp --dport 445 -j DROP
iptables -A FORWARD -p udp --dport 137:138 -j DROP

# Log all attempts
iptables -A FORWARD -d 192.168.66.0/24 -j LOG --log-prefix "WIN2000-BLOCK: "

:: Disable NetBIOS over TCP/IP
wmic nicconfig where TcpipNetbiosOptions=0 call SetTcpipNetbios 2

:: Disable LLMNR (not available in Win2000, but disable NetBIOS broadcast)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" ^
  /v NodeType /t REG_DWORD /d 2 /f

:: Disable IPv6 (if somehow installed)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" ^
  /v DisabledComponents /t REG_DWORD /d 0xffffffff /f

:: Disable unnecessary protocols
netsh interface ip delete wins all

:: SMB Security Configuration
:: Minimal SMB exposure

:: Require SMB signing
reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" ^
  /v RequireSecuritySignature /t REG_DWORD /d 1 /f

reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" ^
  /v EnableSecuritySignature /t REG_DWORD /d 1 /f

:: Disable SMB1 (if possible - may break functionality)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" ^
  /v SMB1 /t REG_DWORD /d 0 /f

:: Restrict anonymous access
reg add "HKLM\System\CurrentControlSet\Control\Lsa" ^
  /v RestrictAnonymous /t REG_DWORD /d 2 /f

:: Secure DNS configuration

:: Disable DNS recursion
dnscmd /config /NoRecursion 1

:: Enable DNS secure cache
reg add "HKLM\System\CurrentControlSet\Services\DNS\Parameters" ^
  /v SecureResponses /t REG_DWORD /d 1 /f

:: Restrict zone transfers
dnscmd /zoneresetsecondaries domain.local /SecureList 10.0.0.20

:: Remove default shares
net share C$ /delete /y
net share D$ /delete /y
net share ADMIN$ /delete /y
net share IPC$ /delete /y

:: Disable automatic share creation
reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" ^
  /v AutoShareServer /t REG_DWORD /d 0 /f

:: Create restricted share if needed
net share Data=C:\SharedData /grant:DataUsers,READ

:: Restrict RPC endpoints

:: Configure RPC to use specific ports
reg add "HKLM\Software\Microsoft\Rpc\Internet" ^
  /v Ports /t REG_MULTI_SZ /d "5000-5100" /f

reg add "HKLM\Software\Microsoft\Rpc\Internet" ^
  /v PortsInternetAvailable /t REG_SZ /d "Y" /f

reg add "HKLM\Software\Microsoft\Rpc\Internet" ^
  /v UseInternetPorts /t REG_SZ /d "Y" /f

:: Restart RPC service
net stop rpcss /y
net start rpcss

#!/usr/bin/env python
# Simple network monitor for Win2000
# Detects suspicious connection attempts

import socket
import time
import threading

class NetworkMonitor:
    def __init__(self):
        self.suspicious_ports = [445, 139, 135, 23, 21]
        self.alert_log = open("network_alerts.log", "a")

    def monitor_port(self, port):
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.bind(('', port))
        sock.listen(1)

        while True:
            conn, addr = sock.accept()
            alert = "[ALERT] Connection attempt on port %d from %s" % (port, addr[0])
            print alert
            self.alert_log.write(alert + "\n")
            self.alert_log.flush()
            conn.close()

    def start_monitoring(self):
        for port in self.suspicious_ports:
            try:
                thread = threading.Thread(target=self.monitor_port, args=(port,))
                thread.daemon = True
                thread.start()
            except:
                pass

if __name__ == "__main__":
    monitor = NetworkMonitor()
    monitor.start_monitoring()

    while True:
        time.sleep(60)

' Analyze security logs for network attacks
' Save as analyze_network_logs.vbs

Set objWMI = GetObject("winmgmts:\\.\root\cimv2")

' Check for failed logon attempts (network)
Set colLoggedEvents = objWMI.ExecQuery _
    ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventCode = 529")

WScript.Echo "Failed Network Logon Attempts:"
For Each objEvent in colLoggedEvents
    WScript.Echo "Time: " & objEvent.TimeWritten
    WScript.Echo "Source: " & objEvent.SourceName
    WScript.Echo "Message: " & objEvent.Message
    WScript.Echo "---"
Next

' Check for port scans
Set colNetEvents = objWMI.ExecQuery _
    ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND EventCode = 4226")

WScript.Echo vbCrLf & "Possible Port Scans Detected:"
For Each objEvent in colNetEvents
    WScript.Echo "Time: " & objEvent.TimeWritten
    WScript.Echo "Details: " & objEvent.Message
Next

@echo off
:: EMERGENCY NETWORK ISOLATION SCRIPT
:: Run when compromise is suspected

echo EMERGENCY NETWORK ISOLATION INITIATED
echo =====================================

:: 1. Disable all network adapters
echo Disabling network adapters...
wmic path win32_networkadapter where NetConnectionStatus=2 call disable

:: 2. Stop network services
echo Stopping network services...
net stop "Computer Browser" /y
net stop "Server" /y
net stop "Workstation" /y
net stop "TCP/IP NetBIOS Helper" /y
net stop "Remote Registry" /y
net stop "Windows Time" /y

:: 3. Flush DNS cache
ipconfig /flushdns

:: 4. Clear ARP cache
arp -d *

:: 5. Clear NetBIOS cache
nbtstat -R

:: 6. Block all traffic with IPSec
netsh ipsec static add policy name="EMERGENCY_BLOCK_ALL"
netsh ipsec static add filteraction name="BLOCK_ALL" action=block
netsh ipsec static add filterlist name="ALL_TRAFFIC"
netsh ipsec static add filter filterlist="ALL_TRAFFIC" srcaddr=any dstaddr=any protocol=any
netsh ipsec static add rule name="BLOCK_EVERYTHING" policy="EMERGENCY_BLOCK_ALL" filterlist="ALL_TRAFFIC" filteraction="BLOCK_ALL"
netsh ipsec static set policy name="EMERGENCY_BLOCK_ALL" assign=yes

echo.
echo NETWORK ISOLATION COMPLETE
echo Document all changes before re-enabling network
pause

:: Capture network state for forensics before isolation

:: Save current connections
netstat -anb > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_netstat.txt

:: Save routing table
route print > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_routes.txt

:: Save ARP cache
arp -a > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_arp.txt

:: Save DNS cache
ipconfig /displaydns > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_dns.txt

:: Save open sessions
net session > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_sessions.txt

:: Save open files
net file > %DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_files.txt

Phase 1 - Assessment (Week 1):
  - Map all network dependencies
  - Document firewall rules
  - Identify integration points
  - Plan new network architecture

Phase 2 - Parallel Network (Week 2-3):
  - Build new network segment
  - Configure modern security controls
  - Test connectivity
  - Validate security posture

Phase 3 - Gradual Migration (Week 4-8):
  - Migrate services individually
  - Update DNS records
  - Redirect traffic gradually
  - Monitor for issues

Phase 4 - Cutover (Week 9-10):
  - Final service migration
  - Update all references
  - Decommission old network
  - Document new configuration

# Modern network security configuration
# For the replacement system

# Enable Windows Firewall with Advanced Security
netsh advfirewall set allprofiles state on

# Configure strict rules
netsh advfirewall firewall add rule name="Block_SMBv1" dir=in action=block protocol=tcp localport=445

# Enable network isolation
netsh advfirewall firewall add rule name="Isolate_Legacy_Subnet" dir=in action=block remoteip=192.168.66.0/24

# Configure IPSec
netsh advfirewall consec add rule name="Require_IPSec" endpoint1=any endpoint2=any action=requireinrequireout