Now that taken some time to enumerate web pages on port 80 and four for three.
We're gonna go ahead and shift our focus over to SMB on port one thirty nine.
So if you are unfamiliar with what SMB is SMB is a file share.
So think about your work environment.
If you go to work and let's say that you have a drive you access that's not like your common drive a
C drive.
Maybe it's like a Z drive or a G drive and you access that that drive to get files and you can upload
the files download the files and then maybe some of your co-workers can also see that file share.
And that's why it's called a file share.
Another example is say you have a scans folder and you go to your printer and you scan something and
magically it appears in your scans folder on your computer.
That's another example of SMB So S&P is commonly used in work environments and internal environments.
So when we see it we think internal and we think about all these exploits that I have mentioned in the
past with especially with latest and greatest being M.S. 17 0 1 0 and even though it's 2 years old it
still shows up and it's gonna show up again in this course later on.
So we're gonna do is we're just gonna take a quick look at our scan and see what we have available to
us.
So on port one thirty nine here we see that.
OK.
Net bios SMB workgroup my group.
Not really a lot of information we could scroll down and the great thing about the dash capital a that
I had you run with this scan is that it does run script for us.
So these scripts that we're running go out and do a little bit of a numerator iron or additional enumeration
in here it came through and it's pulling down some information we could see that.
Okay.
The net bios theme of this is called Capture X..
Well we already knew that but and we can see here that it's running SMB version too.
We really don't know that for sure or what S&P version it's running.
Exactly.
So that's really important because the type of SMB version that's running could potentially lead to
an exploit and we need to know that kind of information.
So we're gonna look for version information.
The other thing is we're going to try to connect to this machine.
We're going to see if there's any connections available to us.
And if we can make that connection if we can get to the files on the share and see if there's anything
potentially malicious or that we could do potentially malicious.
So let's go ahead and let's get into a terminal and we're going to load up a tool that you're going
to be intimately familiar with.
By the time this course is over and that tool is called Meadows flight so to run that tool just go ahead
and type an MSF console like this and hit enter.
Now Meadows boy is a exploitation framework and it does a lot more than exploitation.
As you could see down here you could see that it does exploits what are called auxiliary modules now
auxiliary modules is like scanning an enumeration so we can actually do port scanning we can do all
kinds of information gathering with these auxiliary modules.
They're awesome.
We're gonna go through one right now.
There's also these post modules which do post exploitation.
So say we get a a shell on a machine which means we've exploded a machine.
We can do some things in post.
There's all different types of payloads which are going to cover when we get into the exploit section
and then the rest of this you'll have to worry about that for the scope of this course but we will be
seeing another tool by that display which is MSF venom later in the exploit development section of the
course because we're going to utilize that to build payloads out for our own shells.
So what we're gonna do for now is we're just going to introduce this slowly.
Don't feel overwhelmed.
It's just a little bit of a learning curve when it comes to learning all the features that it has available
but it's second nature once you learn it and it's gonna be one of the most commonly used tools that
you use as a tester in the field.
So we're gonna go ahead and just search for SMB here and I'm going to do this the terrible way we're
just going to search SMB and you could see that there's one hundred and twenty one results.
Now that's going to be quite a pain to sift through but what we're after and say we we didn't know much
but we were we're trying to see if hey maybe does medicinally have any kind of modules.
I don't know for SMB enumeration.
Well we know auxiliary modules are enumeration and we can look right here in the front and see what
type of module it is.
So you see this is a post module and you see if you could scroll up we're going through exploits now
we're gonna go up into auxiliary.
Now the second part of this is the type of of action it's doing so you could see auxiliary denial service
auxiliary fuzzing auxiliary scanning gathering and we're going to utilize this to our advantage.
We're going to take a look at the syntax.
Now what we are after is SMP version information.
And if we look kind of through this we can come down a scanner here and you can see it's looking S&P
1 to GBP which we're going to talk about MH 17 0 1 0 which we've talked about.
You have an auxiliary scanner to see if there's anything out there with that vulnerability.
And if we look right here on number 60 auxiliary scanner SMB SMB version.
Now this is a bit of a long convoluted way to do this.
Go ahead and copy this by the way or memorize your number I'll give you two options.
This is a long way to do it but I wanted to show you this way of doing it because you're going to get
better at it but you know when you see something on a scan results and you don't know a lot about the
tool the best thing that you can do is just say hey you know I know medicinally does things like this.
Let me see if maybe they have any sort of enumeration or exploitation.
It never hurts to use a search feature to try to look up items and learn about them.
So let's say we've never used this before.
We're gonna go ahead and just say use and then we're gonna paste this module in here.
Your other option is instead of pasting this module you can put the number that you had.
So like for example 60 you could say use 60 and it will also love this model.
So go ahead it hit enter for that and you can see here that it says now we're an auxiliary module of
scanner S&P.
S&P underscore version so from here it's always good to type out info and see what info is available
and just tells you a little bit about the module that you're running so here you see that this is going
to display version information about each system.
Perfect.
It's an S&P version detection.
That's really what we're after right now.
So this is great.
And we have options here.
These basic options.
Now you're going to see me do this a lot.
You can go right into options by just typing options and just see that instead of printing out all the
long stuff if you don't want to.
So our options were presented with some items.
We've got something called our hosts.
Now our hosts are what stands for remote hosts.
You're also going to see an el host later on which chance for local hosts.
Our host is always the victim.
That's who we are attacking.
This is the target address.
You might see our host or our hosts plural.
Our hosts means you can only import one host if we have our hosts plural.
We can use cyber notation mean that we can put slash twenty four and try to sweep a range for example.
But in this instance we're only attacking one machine anyway.
The rest of these SMB domain password and user if we knew the domain password and user in this instance
we could fill it out and try to get a little bit more information.
But we are an authenticated.
We have no credentials at this point so we're just gonna go ahead and just put in our hosts which is
required and not feel any of the non required fields here.
And what we're gonna do is we're just gonna say set our hosts and this is in case sensitive.
I'd just like to type it out of case sensitive.
And then the IP address of the machine that you're going to scan.
So we're gonna say 1 9 2 1 6 8 minus 5 7 dot 1 3 9 and then I'm just gonna type in run give you a second
to catch up and run okay.
I totally lied my IP address is one thirty nine the machine I'm after is one thirty four and run your
screen should look something like this I'm over here instead of copying pasting trying to memorize so
hopefully you can see that I make mistakes too.
So here we are.
We see a little bit more information and it might not look like a lot right now but knowing this samba
to point to point one A is very specific and this is going to help us out quite a bit.
So let's just copy this guy and let's open up that text editor we've had going and let's just come in
here and maybe make some notes or just put it in here and say something like SMB and then we can just
put paste that we know the version now and this is going to become important when we start doing research
on what we've found.
So we found all these different type of versions running up here and we're and do research on exploitations
against them but we're also going to do research on this and exploitations against this.
So as much detail as we can get.
That's what's important and what's going to set you apart from other hackers or other people even trying
to break into the field is your ability to information gather and your ability to enumerate if you can
do both of those.
The exploitation is actually the easy part.
In my opinion.
So we've got the virgin information that's great.
We're going to use a new tool now.
So go ahead and go file new tab and I'm going to go ahead and show you a tool called SMB client now
SMB client is going to attempt to connect to the file share that's out there.
Now if we have the ability to connect to the file share with anonymous access what that will do is we
can get in there and we could potentially see files.
Now these files might give us an inkling of what's going on the network or they may even be you know
valuable to us.
They may be something like a backup file or password stored in a text file.
You never know what you're going to find until you actually look.
So what I'm going to go ahead and do is do a dash L and that's going to be to list out the files and
then the syntax looks something like this.
You can do two back slashes.
I'd like to do four.
It really doesn't matter.
And then you just type in the IP address of the machine that you want to try to connect to.
So 1 9 2 1 6 8 fifty seven one thirty four for me.
And then two more slashes like that if you're running it with just two slashes you don't have to put
any there.
So this is just character escaping because we're in Linux.
So go ahead and hit enter and you see that the server does not support extended security.
OK.
Don't worry about that anonymous log and successful.
Go ahead and hit enter and root password as we don't know it.
And you could see that we did list out a file share.
So let's go ahead and try to connect a different way.
Let's tab up and let's delete this dash shell and we see that there's two file shares.
There is an IP see dollar sign in an AB and dollar sign.
The IPC is not really usually valuable to us but to AB and would be really valuable if we could connect
to that.
Let's go ahead.
Just paste that in here and see if we can get that connection.
OK let's try this.
Hit enter and you could see we have.
Wrong password.
So it's not going to let us connect to this.
Share with anonymous access.
So that's unfortunate.
We could also try.
Proof of concept to see if IPC works hit enter on that and you can see now we're actually in this in.
This is interesting.
So we could say help to see the list of commands.
And it's very similar to being inside of a Linux machine.
Now we can do something like l asked to list the files and we're actually access denied here.
So this is what we call a dead end.
We can't really access this.
So we don't have any information extra gathered.
We're going to come back to this time and time again with SMB client.
This isn't the last time you're going to see it in the course.
But I want you to know that it exists in the reason behind what we're doing here and this is some of
where the information's coming from in our scan.
We're trying to connect out.
We see the server names cap tricks.
There's a comment that it's a samba server and we're going to try to come in here and connect to a file
and maybe get lucky.
But this time we didn't get lucky.
So we're just gonna go ahead and x out so that's all you need to know right now for S&P.
S&P is an amazing protocol when I see S&P I get very happy.
But we're going to focus on that very heavily when we get into the internal part of the Active Directory
portion of this course because that's when things get really juicy.
Right now we're just going to do.
Keep it simple stupid on a lot of this stuff.
It might feel really easy or very very straightforward depending.
But I promise this is just going to keep building and building and building until we have a pretty big
understanding on this.
And there's going to be a lot of repetition and a lot of practice and I think that's the best way to
learn.
So from here I'm going to do a brief enumeration on SSA and how we can do enumeration with SSA age and
then we're going to talk other items of enumeration and talk research.
What are we doing.
We've been collecting all this information and putting it into a text document.
You're probably like so what.
What can we do with it.
And that's where things get exciting and that's how we start to lead into exploitation.
But we've got do a little bit more research first before we can get there.
So that's it for this video.
I'll catch you over in the next video when we are a Newman rating SS age.