All language subtitles for 5. Enumerating SMB

Now that taken some time to enumerate web pages on port 80 and four for three.

We're gonna go ahead and shift our focus over to SMB on port one thirty nine.

So if you are unfamiliar with what SMB is SMB is a file share.

So think about your work environment.

If you go to work and let's say that you have a drive you access that's not like your common drive a

C drive.

Maybe it's like a Z drive or a G drive and you access that that drive to get files and you can upload

the files download the files and then maybe some of your co-workers can also see that file share.

And that's why it's called a file share.

Another example is say you have a scans folder and you go to your printer and you scan something and

magically it appears in your scans folder on your computer.

That's another example of SMB So S&P is commonly used in work environments and internal environments.

So when we see it we think internal and we think about all these exploits that I have mentioned in the

past with especially with latest and greatest being M.S. 17 0 1 0 and even though it's 2 years old it

still shows up and it's gonna show up again in this course later on.

So we're gonna do is we're just gonna take a quick look at our scan and see what we have available to

us.

So on port one thirty nine here we see that.

OK.

Net bios SMB workgroup my group.

Not really a lot of information we could scroll down and the great thing about the dash capital a that

I had you run with this scan is that it does run script for us.

So these scripts that we're running go out and do a little bit of a numerator iron or additional enumeration

in here it came through and it's pulling down some information we could see that.

Okay.

The net bios theme of this is called Capture X..

Well we already knew that but and we can see here that it's running SMB version too.

We really don't know that for sure or what S&P version it's running.

Exactly.

So that's really important because the type of SMB version that's running could potentially lead to

an exploit and we need to know that kind of information.

So we're gonna look for version information.

The other thing is we're going to try to connect to this machine.

We're going to see if there's any connections available to us.

And if we can make that connection if we can get to the files on the share and see if there's anything

potentially malicious or that we could do potentially malicious.

So let's go ahead and let's get into a terminal and we're going to load up a tool that you're going

to be intimately familiar with.

By the time this course is over and that tool is called Meadows flight so to run that tool just go ahead

and type an MSF console like this and hit enter.

Now Meadows boy is a exploitation framework and it does a lot more than exploitation.

As you could see down here you could see that it does exploits what are called auxiliary modules now

auxiliary modules is like scanning an enumeration so we can actually do port scanning we can do all

kinds of information gathering with these auxiliary modules.

They're awesome.

We're gonna go through one right now.

There's also these post modules which do post exploitation.

So say we get a a shell on a machine which means we've exploded a machine.

We can do some things in post.

There's all different types of payloads which are going to cover when we get into the exploit section

and then the rest of this you'll have to worry about that for the scope of this course but we will be

seeing another tool by that display which is MSF venom later in the exploit development section of the

course because we're going to utilize that to build payloads out for our own shells.

So what we're gonna do for now is we're just going to introduce this slowly.

Don't feel overwhelmed.

It's just a little bit of a learning curve when it comes to learning all the features that it has available

but it's second nature once you learn it and it's gonna be one of the most commonly used tools that

you use as a tester in the field.

So we're gonna go ahead and just search for SMB here and I'm going to do this the terrible way we're

just going to search SMB and you could see that there's one hundred and twenty one results.

Now that's going to be quite a pain to sift through but what we're after and say we we didn't know much

but we were we're trying to see if hey maybe does medicinally have any kind of modules.

I don't know for SMB enumeration.

Well we know auxiliary modules are enumeration and we can look right here in the front and see what

type of module it is.

So you see this is a post module and you see if you could scroll up we're going through exploits now

we're gonna go up into auxiliary.

Now the second part of this is the type of of action it's doing so you could see auxiliary denial service

auxiliary fuzzing auxiliary scanning gathering and we're going to utilize this to our advantage.

We're going to take a look at the syntax.

Now what we are after is SMP version information.

And if we look kind of through this we can come down a scanner here and you can see it's looking S&P

1 to GBP which we're going to talk about MH 17 0 1 0 which we've talked about.

You have an auxiliary scanner to see if there's anything out there with that vulnerability.

And if we look right here on number 60 auxiliary scanner SMB SMB version.

Now this is a bit of a long convoluted way to do this.

Go ahead and copy this by the way or memorize your number I'll give you two options.

This is a long way to do it but I wanted to show you this way of doing it because you're going to get

better at it but you know when you see something on a scan results and you don't know a lot about the

tool the best thing that you can do is just say hey you know I know medicinally does things like this.

Let me see if maybe they have any sort of enumeration or exploitation.

It never hurts to use a search feature to try to look up items and learn about them.

So let's say we've never used this before.

We're gonna go ahead and just say use and then we're gonna paste this module in here.

Your other option is instead of pasting this module you can put the number that you had.

So like for example 60 you could say use 60 and it will also love this model.

So go ahead it hit enter for that and you can see here that it says now we're an auxiliary module of

scanner S&P.

S&P underscore version so from here it's always good to type out info and see what info is available

and just tells you a little bit about the module that you're running so here you see that this is going

to display version information about each system.

Perfect.

It's an S&P version detection.

That's really what we're after right now.

So this is great.

And we have options here.

These basic options.

Now you're going to see me do this a lot.

You can go right into options by just typing options and just see that instead of printing out all the

long stuff if you don't want to.

So our options were presented with some items.

We've got something called our hosts.

Now our hosts are what stands for remote hosts.

You're also going to see an el host later on which chance for local hosts.

Our host is always the victim.

That's who we are attacking.

This is the target address.

You might see our host or our hosts plural.

Our hosts means you can only import one host if we have our hosts plural.

We can use cyber notation mean that we can put slash twenty four and try to sweep a range for example.

But in this instance we're only attacking one machine anyway.

The rest of these SMB domain password and user if we knew the domain password and user in this instance

we could fill it out and try to get a little bit more information.

But we are an authenticated.

We have no credentials at this point so we're just gonna go ahead and just put in our hosts which is

required and not feel any of the non required fields here.

And what we're gonna do is we're just gonna say set our hosts and this is in case sensitive.

I'd just like to type it out of case sensitive.

And then the IP address of the machine that you're going to scan.

So we're gonna say 1 9 2 1 6 8 minus 5 7 dot 1 3 9 and then I'm just gonna type in run give you a second

to catch up and run okay.

I totally lied my IP address is one thirty nine the machine I'm after is one thirty four and run your

screen should look something like this I'm over here instead of copying pasting trying to memorize so

hopefully you can see that I make mistakes too.

So here we are.

We see a little bit more information and it might not look like a lot right now but knowing this samba

to point to point one A is very specific and this is going to help us out quite a bit.

So let's just copy this guy and let's open up that text editor we've had going and let's just come in

here and maybe make some notes or just put it in here and say something like SMB and then we can just

put paste that we know the version now and this is going to become important when we start doing research

on what we've found.

So we found all these different type of versions running up here and we're and do research on exploitations

against them but we're also going to do research on this and exploitations against this.

So as much detail as we can get.

That's what's important and what's going to set you apart from other hackers or other people even trying

to break into the field is your ability to information gather and your ability to enumerate if you can

do both of those.

The exploitation is actually the easy part.

In my opinion.

So we've got the virgin information that's great.

We're going to use a new tool now.

So go ahead and go file new tab and I'm going to go ahead and show you a tool called SMB client now

SMB client is going to attempt to connect to the file share that's out there.

Now if we have the ability to connect to the file share with anonymous access what that will do is we

can get in there and we could potentially see files.

Now these files might give us an inkling of what's going on the network or they may even be you know

valuable to us.

They may be something like a backup file or password stored in a text file.

You never know what you're going to find until you actually look.

So what I'm going to go ahead and do is do a dash L and that's going to be to list out the files and

then the syntax looks something like this.

You can do two back slashes.

I'd like to do four.

It really doesn't matter.

And then you just type in the IP address of the machine that you want to try to connect to.

So 1 9 2 1 6 8 fifty seven one thirty four for me.

And then two more slashes like that if you're running it with just two slashes you don't have to put

any there.

So this is just character escaping because we're in Linux.

So go ahead and hit enter and you see that the server does not support extended security.

OK.

Don't worry about that anonymous log and successful.

Go ahead and hit enter and root password as we don't know it.

And you could see that we did list out a file share.

So let's go ahead and try to connect a different way.

Let's tab up and let's delete this dash shell and we see that there's two file shares.

There is an IP see dollar sign in an AB and dollar sign.

The IPC is not really usually valuable to us but to AB and would be really valuable if we could connect

to that.

Let's go ahead.

Just paste that in here and see if we can get that connection.

OK let's try this.

Hit enter and you could see we have.

Wrong password.

So it's not going to let us connect to this.

Share with anonymous access.

So that's unfortunate.

We could also try.

Proof of concept to see if IPC works hit enter on that and you can see now we're actually in this in.

This is interesting.

So we could say help to see the list of commands.

And it's very similar to being inside of a Linux machine.

Now we can do something like l asked to list the files and we're actually access denied here.

So this is what we call a dead end.

We can't really access this.

So we don't have any information extra gathered.

We're going to come back to this time and time again with SMB client.

This isn't the last time you're going to see it in the course.

But I want you to know that it exists in the reason behind what we're doing here and this is some of

where the information's coming from in our scan.

We're trying to connect out.

We see the server names cap tricks.

There's a comment that it's a samba server and we're going to try to come in here and connect to a file

and maybe get lucky.

But this time we didn't get lucky.

So we're just gonna go ahead and x out so that's all you need to know right now for S&P.

S&P is an amazing protocol when I see S&P I get very happy.

But we're going to focus on that very heavily when we get into the internal part of the Active Directory

portion of this course because that's when things get really juicy.

Right now we're just going to do.

Keep it simple stupid on a lot of this stuff.

It might feel really easy or very very straightforward depending.

But I promise this is just going to keep building and building and building until we have a pretty big

understanding on this.

And there's going to be a lot of repetition and a lot of practice and I think that's the best way to

learn.

So from here I'm going to do a brief enumeration on SSA and how we can do enumeration with SSA age and

then we're going to talk other items of enumeration and talk research.

What are we doing.

We've been collecting all this information and putting it into a text document.

You're probably like so what.

What can we do with it.

And that's where things get exciting and that's how we start to lead into exploitation.

But we've got do a little bit more research first before we can get there.

So that's it for this video.

I'll catch you over in the next video when we are a Newman rating SS age.