Exploiting SAMBA.
Now that we have an idea of how to exploit
multiple services running on a Linux system like FTP,
Shellshock, as well as SSH, let's turn our attention
to the open source Linux implementation of SMB, which
is SAMBA.
However, before we actually get started with the exploitation
section, let's get an idea of what SAMBA is and what,
as an attacker, we are going to be looking for.
All right.
So SMB essentially stands for the Server Message Block.
It is a network file sharing protocol
that is used to facilitate the sharing of files
and peripherals like printers between computers
on a local network also known as a LAN.
Now, SMB uses port 445 by default, which is TCP.
However, originally, SMB ran on top of the NetBIOS port
or protocol using port 139.
And it's not uncommon to find Windows systems as well
as Linux systems running both the NetBIOS
port and the actual SMB port, which
is port 445 as a means of offering compatibility
to older systems that still utilize NetBIOS.
Now, I want to explain something that I did not
explain during the SMB exploitation section
within the Windows exploitation section of this course.
Within that section, we were primarily
focused on obtaining credentials in order
to execute arbitrary commands on the target.
And that was facilitated through the PS exit command
and we also explored other tools like CrackMapExec
and that really is a vulnerability
within the Windows operating system.
And the same thing can be done relatively similarly
on a Linux system.
However, in this video, I want to highlight
another aspect of SMB.
So going back to my original example
that I highlighted within the Windows section,
if you have ever worked within a Windows
environment or an environment that has more than 5 or 10
Windows systems, SMB can typically be used
or is typically used to share files.
And how would you do that?
Well, let's say you're running a system on that local network
and someone asks you to share a file or folder,
well, you could email it to them or you
could copy it to a flash drive and give it to them.
However, the actual pre-determined solution
for this is to set up a file share.
And the file share again, can be configured to essentially only
be accessed by specific users.
But irregardless of that, file share
could contain important information pertinent
to that company or to that particular person.
And once you set up the file share,
you can essentially share that or provide access
to the specific set of files or folders
to really any user on that local area network.
And all of this is being facilitated through SMB
or the SMB protocol.
All right.
So I just want to explain that.
And I want you to keep that in mind
as we are going to be primarily focused
on enumerating shares as well as downloading files
from these shares.
So just keep that in the back of your mind.
Now, SAMBA is the Linux implementation of SMB
and allows Windows systems to access Linux chairs
and devices.
Now, SAMBA doesn't come pre-packaged with most Linux
distributions because again, going back
to the Linux development ideology and philosophy,
the Linux and Unix philosophy essentially
revolves around the fact that a system or rather you should
be able to customize your system and make it work
the way you want it to work.
So it doesn't include any of the additional packages like SAMBA
or FTP or anything like that.
All have to be installed by you--
actually, you need to go ahead and do that yourself, which
is a good thing.
However, as I said, SAMBA is essentially
used to allow Windows systems to access
Linux shares and, of course, devices connected to that Linux
system.
So again, SAMBA isn't really a common port or service
that you typically find running on a Linux server,
but it's something that you might
find running on an internal network or on a Linux server
within an internal network.
So it's always good to know how to exploit SAMBA.
Now, I've already covered the process
of exploiting an inherent vulnerability within SAMBA,
and I did that within my Metasploit course.
So you can check that out, and that will essentially
provide you with a way of obtaining a reverse shell.
In this case, we are focused on firstly identifying
legitimate credentials and then authenticating
with the SAMBA server or with the actual target via SAMBA
and, of course, utilizing those credentials to list out
the shares, download files from the shares, et cetera.
So Samba utilizes username and password authentication just
like SMB in order to obtain access
to the server or a network share.
Now, in order to obtain these credentials,
we can perform a brute force attack with Hydra.
And again, once we've obtained these credentials,
we can use a utility called SMB map, which
comes pre-packaged with Kali Linux
in order to enumerate SAMBA shared drives, a list
the contents of the shares, as well
as download files, and execute remote commands on the target.
We can also utilize a tool called smbclient.
Smbclient is a client that is part of the SAMBA software
suite, and it communicates with the LAN manager server,
offering an interface similar to that of the FTP program,
and it can be used to download files
from the server to the local machine
and vise versa in addition to retrieving directory
information from the actual server.
All right.
So we'll also be exploring other utilities like enum4linux.
But, of course, all of those utilities
really work well when you have legitimate credentials.
Now, I will not be going over a vulnerability
or misconfiguration called the null session misconfiguration,
whereby, the SAMBA server has been
really hasn't been configured to essentially be secure.
And as a result, individual can essentially
authenticate and take a look at the shares
without providing a password.
That is something that you will really not
find on any modern system.
So I will be skipping over that, and we
are going to be targeting a system that
has a properly secured instance of SAMBA running
and consequently, with various shares that
contain interesting files that we
are going to be trying to get.
All right.
So this video has a lab environment attached to it
that will allow us to showcase some of these techniques.
So just fire up the lab environment as will I.
And I'll see you within the lab environment, where
we can get started with the process of exploiting SAMBA.
All right.
So I'm back in the lab environment.
And again, in this lab environment,
you'll not be provided with a desktop interface
or a desktop environment, you'll just
be provided with a terminal, which is perfectly fine.
And, of course, the next logical step
would be to identify the target IP, which can
be done by typing in ifconfig.
And you want to take a look at the interface ethernet1 that
is your IP right over here.
The subnet is going to be different in your case.
The target IP or the target system
is running on the next IP within this subnet.
So if your IP, which in your case,
it will be the second IP address on the subnet.
The target IP address is the third IP address on the subnet.
So all you need to do is just copy the IP address.
And as I said, of course, in your case,
it's going to be different.
All you need to do is just change the 2 to a 3
and that's the target IP.
So the first thing we're going to do now is run an Nmap scan,
and I'm just going to perform a service version detection scan.
And I'm going to paste in the target IP.
So again, remember to replace the 2 with a 3,
and I'll hit Enter.
And let's see what we're able to identify.
All right.
So we can see that this target is running SAMBA,
and the actual service version is not displayed.
But we know it's anywhere from version 3 to version 4.
And you can see you have the NetBIOS port as well as
the typical the standard SMB port, which is port 445.
All right.
So as you can see here, the service info
tells you that it's SAMBA recon brute.
So again, that's just a bit of information there.
All right, so the first thing we need to do
is we need to perform a brute force on SMB or SAMBA
running on this particular target.
Now, this can easily be done through the use of the utility
Hydra, which is extremely versatile in regards
to the actual protocols that it allows you to brute force.
Now, for the purpose of this lab environment,
the usernames that you will need to gain access
to the target system or to the actual SMB shares
have already been provided to you.
And the two of them are going to be admin and Jane.
However, the only one we are going to be utilizing
or essentially using is the admin user.
So within our brute force, we do not
need to specify a word list that contains
the administrator or rather the usernames
that we would like to brute force.
Because we already have the username
we would like to brute force with.
We can just specify it here.
So we're going to say admin and then
we specify the actual word list that contains the password.
In this case, we will say user share metasploit framework,
data, word lists.
And we can utilize Unix passwords.txt
All right.
And I'm going to specify the target IP.
Remember to change the 2 to a 3.
And the protocol is SMB.
And we can hit Enter.
All right.
So there we are.
The brute force is complete, and that
completed relatively quickly.
And that really is the case whenever
you have a one username specified,
the brute force will be much more efficient
because you're only testing the passwords
for that particular username.
So we can see that that was successful,
and we got the password for the admin user, which is fantastic.
So we can now utilize a tool called smbmap.
All right.
So we can just say smbmap here, and I'll just hit Enter.
And this will give you an idea as to how you can
utilize this particular tool.
So if we take a look at the actual documentation.
Here you can see this is a SAMBA share enumerator.
And the actual documentation is actually fantastic,
because it explains how you can use it right over here
through the use of some examples.
So for example, if we wanted to enumerate the shares
on this particular target system,
we can essentially say smbmap and then specify the target
IP using the H option.
And I'll just clear out the terminal there,
and I'll paste in the target IP or change that to a 3.
And the username is admin and the password
that we were able to obtain is password1.
All right.
So I'll hit Enter.
So you can see it's going to say finding
open SMB ports, user SMB session established on the target IP.
And you can see the actual host name of the system is target1.
It then provides you with the actual disks here.
So these are the shares.
So you have Shawn, Nancy, admin and IPC.
And in terms of Nancy, this is a read-only share.
And then, of course, you have Shawn, an admin.
All right.
So what if we wanted to access any of these particular shares?
Well, we can do that through the use of smbclient.
So we can say smbclient, and I'll hit Enter.
And smbclient documentation really isn't that good,
but you can get more by opening the actual manpages
for smbclient so you can say man smbclient
and you can see this is an FTlike client
to access SMB/CIFS resources on servers.
All right.
So this will provide us with an FTP type interface that
will allow us to dynamically navigate around
the actual shares.
OK.
So we can say smbclient and then we
specify that we want to list out the shares.
We paste in the target IP.
And then we can specify the user that we would
like to authenticate with.
So we can say user is admin, hit Enter.
It's going to ask us for the admin's passwords.
I'll say password1.
And again, you can see it provides us
with pretty much the same information.
However, in this case, it provides us
with the actual work group.
In this case, the name of the work group is recon labs.
OK.
So if we wanted to gain access to the actual smbclient
itself or rather the interface, we can say smbclient,
and we then specify the target IP.
So I'll change that to a 3 and then specify the actual share
name that we would like to access.
So in this case, I can try Shawn or Nancy.
So for example, we can start off with Shawn,
and then I can authenticate as the user admin,
and I'll hit Enter.
It's going to ask me for the password.
I'll type that in.
As you can see, it provides you with the SMB console.
So we can utilize the help command here
to display the list of commands that we can run.
And these really are just relative
or are essentially used to navigate
around the actual shares.
So for example, I can say dir and that
will list the actual folders or directories
within the share Shawn.
So I can go into maybe the dev directory.
So I can say cd dev, dir, nothing within there.
I can take a step back, cd run, dir, nothing in there.
And CD test, same thing, dir, nothing in there.
OK.
So we've hit a dead end.
There really isn't anything within that share.
So let's try the next share, which, in this case, was Nancy.
And then we'll move over to the admin share.
All.
Right so I'll say Nancy, password1.
There we go.
Dir, we have a srv directory, dir, nothing in there,
and cd dir, dir, nothing in there.
It looks like we have a flag here.
All right.
So we can get or download a file from an SMB server
by using the Get command.
So we'll say get flag.
There we are.
It downloads successfully, and then we can exit.
And we list out the contents of our current working directory.
We have the first flag.
So we can say cat flag.
That's the first flag right over there.
All right.
So now, let's try and access the admin share.
So I'm going to say smbclient target IP,
and we want to access the admin share.
There we go.
And we'll hit Enter, password1, dir,
we have a hidden directory.
So we can go into the hidden directory here.
And it looks like we have a flag or rather
an archive that contains the flag.
So you can see it's called flag.tar.gz or gzip.
We can get it by saying get flag.tar.gzip, hit Enter.
It's going to download that, and we're going to exit.
So I'm just going to remove the flag that I downloaded earlier.
And we are going to extract this with tar.xzf, flag.tar.gz
and a list of the contents here.
I can then cut out the content of the extracted archive, which
is flag, hit Enter, and we obtain the second flag.
All right.
So you can see that the two flags are different.
And again, this lab environment was set up to showcase
how you can perform a brute force attack on SAMBA,
obtain the credentials, and then enumerate shares.
And, of course, this process can also
be done for Windows systems.
Now, the other utility that I wanted to highlight
was enum4linux.
So I'll say enum4linux and I'll use
the A option to enumerate all information,
and I'll paste in the target IP.
Now, let's see what happens.
OK.
So you can see that it gets basic target information right
over here, and it gives us the actual work group,
and you can see right over here looking up
the status of the actual SMB or SAMBA
instance running on the target.
And you can see it tells us right away the server
doesn't allow session using a null username and password.
So that pretty much tells us that SMB or SAMBA
has been configured correctly and null sessions are not
allowed.
Now, if they were allowed, we would
be able to enumerate much more information
with this particular utility.
So let's learn a bit more about enum4linux.
So I'll hit Enter.
All right.
So there we are.
You can see it'll give you a bit of an idea as to what
it can do.
So simple wrapper around the tools in the SAMBA package
to provide similar functionality to enum.exe.
And what it does, it allows you to enumerate
as much information as possible from SAMBA running on a target.
So you can enumerate information like you
can obtain a user list or a list of users, the machine list,
you can also get a list of shares, the password policy
information, et cetera.
And because in this case, the null sessions
have not been enabled, we'll need
to specify the credentials that we obtain from the brute force.
So for example, I can say enum4linux
and then I can say maybe I want to enumerate all information
right over here.
So this will enumerate the users, shares, et cetera.
And I can then specify that I want to authenticate.
So I can say the user is admin and the password is password1
and then the target IP.
I'll hit Enter.
And now, you can see it's going to go through the entire gamut
of checks.
So we'll give this a couple of seconds to complete.
All right.
So the checks have completed.
And as you can see right at the bottom,
it'll also check for printer information.
And it'll tell us no printers returned.
And let's take a look at all of the information displayed right
from the beginning.
Because again, this is very, very comprehensive
in regards to the information that it provides you with.
So we can see that we authenticate successfully,
and it'll give you the operating system information.
And in this case, it's not really accurate,
because it's going to assume that it's
running Windows NT 6.1, which is not really a problem.
Now, the important information is here.
So we have used an enumeration.
So it provides us with the other user accounts
that we can access.
And we, of course, gained access via admin.
As I said, we also have the user Jane, Nancy, and Shawn.
Obviously, we were able to enumerate that from the shares.
And then, of course, it enumerates the shares
that we were able to obtain with smbmap and, of course,
smbclient.
So it's going to attempt to map the shares,
and it'll do that successfully right over there.
And then, of course, it'll go through the password policy
information here, which can be quite important, especially
if SSH is running on the target.
And then it will obtain the SIDs for the actual user accounts.
So right over here, you can see it
obtains the actual SIDs for all of the users,
so on, and so forth.
And you can see these are the actual groups.
And there we are.
So that is how to use enum4linux to perform enumeration
on SAMBA.
All right.
So now, that we've explored these three tools,
this is going to conclude the practical demonstration
side of this video.
All right.
So now that we've taken a look at how
to exploit services running on Linux
or some of the frequently exploited Linux services,
we can now turn our attention to performing privilege escalation
on Linux systems through inherent vulnerabilities
or misconfigurations that you will typically
find on a Linux system after you have gained access.
All right.
So I'll be seeing you in the next section.