[ELECTRONIC NOISES]
SMB enumeration-- in this video, we're
going to be taking a look at how to utilize
various auxiliary modules to enumerate
as much information as possible from SMB.
So first and foremost, what is SMB?
SMB stands for the Server Message Block.
It is a network file sharing protocol
that is used to facilitate the sharing of files and devices
between computers on a local network, also known as a LAN.
So if you've ever worked on a Windows environment
where one or more Windows computers are connected
to each other locally, then you should be familiar with SMB
even if you've never heard of it.
An example of this would be when you
are trying to set up a file share so
that you can share files from your PC
to other PCs on the network.
And this is all facilitated through SMB.
Another example of this is if you want to set up a share
or, rather, you want to allow other users on a network
to access a printer that is connected to your PC.
This is, again, handled and facilitated by SMB.
Now, SMB uses port 445 on the TCP stack.
However, originally on older versions of Windows SMB
ran on top of the NetBIOS protocol using port 139
and was available on both 139 and 445.
However, on newer versions of Windows
and in, again, modern networks SMB
is usually found on port 445 on the TCP stack.
Now, what happens when we move over to Linux?
Does Linux have SMB?
Or can we actually share files with Linux?
Absolutely.
This is where SAMBA comes into play.
SAMBA is the Linux implementation of SMB
and essentially allows Windows systems
to access Linux shares and devices and vice versa.
So, again, typically when we're talking about SMB on Windows,
it's simply called SMB.
However, when we're talking about SMB on a Linux target
it's called SAMBA.
But the technology essentially works the same.
And really, nothing changes when it comes down to enumeration.
Now, we can utilize auxiliary modules
to enumerate SMB information like the SMB version.
Now, the SMB version is not just important in identifying
what version of SMB is running.
It is also important in identifying
the target operating system, which it can do.
We will then take a look at how to enumerate shares
and enumerate users as well as perform a brute force
attack in order to identify users in passwords
or, rather, the passwords for specific users.
We will also explore the process of how
we can utilize these credentials to authenticate to the SMB
server and then of course download files, upload
files, et cetera, and how we can access shares.
So let's get started with the lab environment.
I am back in the lab environment.
And the first thing we want to do is identify the target IP.
So we will say ifconfig, hit Enter,
and we are looking for the interface ethernet 1.
And We can get our IP right over here.
And as per the way the lab is set up,
the target IP is going to be 192.91.46.3.
And of course, this will change in your case.
However, all you need to do is just change the 2 to a 3.
So, again, I'll just copy that.
That is going to be the target IP.
And I'll clear up my terminal.
The next thing we want to do is start up
the PostgreSQL service.
That is going to start up the PostgreSQL database server
so that we can interact with the Metasploit framework database.
I'm now going to start up the Metasploit framework console.
Once that is started up, we can, again,
add a new workspace for our activity.
So in this case, we're just going to call it smb_enum.
There we go.
Workspace smb_enum is added and currently active.
Now, before we actually proceed, I'm
going to show you a little trick that you
can do with the Metasploit framework
in regards to the target IP because as we've already
seen within the previous videos accessing the target IP
and memorizing it is really not a good way of, again,
moving or working our way through the lab.
And this is where we have the Metasploit framework module
variables.
And as I mentioned within the earlier videos,
we can essentially set up a global variable for the target
IP.
So we can say setg, and that is going to set a global variable.
And the variable that we're going to be setting
is the rhost option, which is the target IP.
We then paste in the IP we copied
and, again, change the 2 to a 3.
And now what that means is that this IP will
be set for the rhost variable with whichever
module that we use.
So, again, that's going to save us a lot of time.
Now given that is done, we can actually
move on to the next step, which is, again,
the process of searching for SMB auxiliary modules.
So we can essentially say search smb and hit Enter.
And as you can see this is not a very good search
because it actually returns a lot of results.
So what we can do is narrow down our search
results, which I'm going to do.
So I'm going to say search, and I
am going to say search type is going
to be an auxiliary module, so auxiliary.
And then the name is SMB and this
is going to bring up only SMB modules and more specifically
auxiliary SMB modules.
So the first thing we want to do is
we want to identify the version of SMB that
is running on the target.
So we are looking for the SMB version module, which
is right over here, which is an auxiliary scanner
SMB, SMB version.
So we can just copy that, and we can then say use and then
paste in the module name that is currently loaded and active.
If we say show options, we don't need
to set the target IP because we already
set the global variable.
That's excellent.
We don't have the SMB domain, the SMB pass, or the SMB user.
So we cannot provide any information there.
You can also increase the number of threads.
But in our case, we're only scanning one target.
So I'm just going to run and give that a few seconds.
As you can see, it's going to tell us
host could not be identified.
But it provides us with the version of SAMBA
that's running on the target.
And in some cases, you may get an incorrect operating system
detection banner.
So in this case, you can see it says Windows 6.1.
But then in brackets, the banner says SAMBA 4.3.11,
and this is on Ubuntu.
So this is exactly what is running on the target.
And now we've been able to identify that it is a SAMBA
server, and it's being run on an Ubuntu Linux
distribution or server.
So we've already identified some useful information there.
Now we can utilize this version information
to try and find out whether this particular version of SAMBA
is vulnerable to an inherent vulnerability
that we can exploit to gain access to the target.
However, in this case, we're not going to be exploring that.
So now that we've identified the SMB version,
the next thing we can do is try and search or try and enumerate
users.
So we are going to, again, just use our previous search filter.
So that is such.
The type is auxiliary, and the name is SMB.
And we are looking for SMB enum users, which
is this module right over here.
As you can see, the information says that this
is SMB user enumeration module.
So what it'll do is it'll actually, again, enumerate
the users, the SMB users.
So we're going to say use and hit Enter.
That's going to load that new module.
Now if you want to learn more about a particular module,
you can type in the info command.
And as you can see, it says the name.
It also provides you the module name itself and a few licensing
information.
And as you can see, the description says,
this will determine what local users exist via the SAM RPC
service, which essentially means we should be able to identify
some user accounts with this.
So the target-- the rhosts option has already been set,
so we don't need to do that.
Again, we don't have any of the other information here,
so we don't need to provide it and aren't
required to provide it.
So all we need to do now is just hit run.
And as you can see, it performs the check successfully.
So it says SAMBA recon, and we get a list
of users right over here.
So we have John, Ella, Aisha, Shawn, Emma, and admin.
The admin user looks interesting,
and we are going to get to that in a few seconds.
So I want you to take down or take a note of these usernames
and save them because they will come in handy in a few seconds.
So now that we have enumerated the users, what we can do
is take a look at how to enumerate shares, which
is, again, why we are performing enumeration because shares
could potentially allow us to access files that
have been shared on this particular SMB server.
And these files could potentially
be useful in gaining access to the target system.
So, again, we'll just search.
We'll just run the search term or the search utility
again here and specify that we're looking
for SMB auxiliary modules.
And as you can see, we have the auxiliary module here, SMB enum
shares, which allows us to enumerate
the shares on this particular SMB server
or on the target system.
So we will say use, paste in the module name
there, and we're going to clear that out.
And we can now say show options.
And as you can see, we now have additional options.
But the rhosts option remains the same.
That's been set globally.
We can add the SMB password and user, but we don't have that.
As for the other options, we can, again, essentially
set the show files option to true
to show detailed information when spidering.
That might be useful.
And we can leave the other options
as they are as they're not really pertinent at the moment.
So we're going to set show files--
let me just correct the syntax there,
so set show files to true.
That is a boolean value.
So for every boolean option, you can, again,
set it to the opposite.
In this case, we're setting it to true,
and then we can just hit run.
So we hit run.
And as you can see, we get various shares.
Now, you might be a little bit confused
because you're seeing users here that we were
able to enumerate previously.
But these are shares for the specific users, which
means we can pretty much access these shares if we
have or are able to get legitimate credentials.
Now, if you remember closely when we essentially
performed the user enumeration, we
were able to identify that there is a user called admin.
So what if we try and perform a brute force in order
to identify the password for the user admin?
And that will consequently give us access
to all of these shares.
So let's actually try and do that.
Now, the way we can actually do that is
by using another auxiliary module called SMB login.
So, again, I'm just going to clear out of that.
And we can just say search SMB login just to get it directly.
There we are.
That's the module there.
This is an SMB login checker similar to the FTP login
checker, which essentially allows
us to perform a brute force.
So I'm just going to copy that and say use, hit Enter.
If we show the options here, you can
see that we have quite a few options.
And I'll go through some of the most important ones.
The first one that we want to set obviously is rhosts.
So, again, in our case that's set, which is great.
rport is set to 445, which again is the correct option.
We now need to specify the user, which
we can do by saying SMB user.
And that is the username to authenticate as, remember,
we are only performing a brute force for the admin user.
And we're not, again, using a user list.
We're just specifying one user.
We then need to set the password file.
So, again, there we are.
That's the file containing the password.
So let's start off by setting the SMB user--
or rather, the SMB username that we want to authenticate with.
So I'm going to say SMB user.
And we're going to set that to admin
because that was the user we were
able to enumerate initially.
We then want to set the password file, which is right over here.
And the word list or the password list
that we're going to be using is similar to the FTP video
where we used the Metasploit framework password list.
So we're going to say user/share/metasploit/framework.
So, again, just type in metasploit/framework and then
data/wordlists.
And we are going to be using unix_passwords.txt.
So we hit Enter.
That's going to set that value or that option.
The other options you can change are the brute force speed
as well as any other required option right over here.
So the other option that we might want to set
is a stop on success.
So that will stop the brute force
once we get a correct password.
And then, of course, the number of threads,
you can also change.
In this case, we're not going to change anything else.
We're just going hit run.
And in this case, it looks like we're
able to identify the password for the user admin.
And in this case, you can see that the password for the user
admin is just password, which again is not a strong password.
But in this case, again, all I'm trying to do
is to demonstrate these techniques to you.
So now that we've identified a username and a password,
we can actually try and check out the various shares
and essentially try and access the files within these shares.
Now, the way we can do this is through a utility
called smbclient, which is not a part of the Metasploit
framework.
But, again, I'm going over above and beyond here
just to demonstrate how useful this information can be.
So what we'll do is I'll just exit from the Metasploit
framework.
There we are.
And in order to use the utility, we can simply say smbclient.
And then we use the -L option, and this is
going to list out the shares.
So we now need to provide the target IP, which again we
can obtain right over here.
That's the target IP there.
And then we can specify the actual share we want to use.
But in this case, we're not really sure what shares
we have because the SMB enum shares module
gave us only three shares, but I think there could be more.
So let's try and do that, and we're
going to log in as the user admin.
So I'm going to say user admin, hit Enter.
It's going to ask us for admin's password.
So I'm going to type it in, which is just password.
We hit Enter.
And as you can see, this will display a list of shares
available.
So we have a public share.
We have a share for the user John, Aisha, Emma,
everyone in IPC.
Now if we want to access any of these shares, what
we'll need to do is we can do it with smbclient.
And in this case, we're not listing out the shares.
We want to log in directly, and we want
to access one of these shares.
So let's start off with the public share.
So we essentially just type in the share name
after the IP address and the two backslashes.
We provide the username that we have credentials for.
So we hit Enter, and then I'm just going to type in password.
And it looks like we're able to log in.
So we're currently interacting with the SMB server
on the target system.
So if I say LS, you can see that we have two directories here.
We have dev and secret.
If we check out the secret directory,
we should be able to get the flag, as you can see there.
In order to download a file from SMB using the smbclient,
we can simply say get and then flag.
And I'll just type that in correctly.
There we are, get flag.
And that is going to save it for us.
And if we exit now, we should have the flag here.
So I'm just going to get the contents of the flag,
and there you are.
So, again, we can also try and access
some of the other shares.
So let me just list all the shares again.
There we are.
We can try and access the share for maybe Aisha.
Let's try that out.
Maybe that will reveal something-- something else,
rather.
So we'll try and access the share for Aisha.
We hit Enter, type in the password that we obtained.
And, again, if we type in LS, it looks
like we have a directory there.
And we cut out the contents of the directory,
and we have another flag, et cetera, et cetera.
So the idea is fairly simple.
We were able to enumerate the SMB version.
We were also able to enumerate the users as well
as the shares.
And furthermore, we were able to perform a brute force
attack in order to identify the password for the admin user.
That information has allowed us to gain access to shares
that we pretty much would not have
been able to access if we didn't have the admin user's password.
So this is really how powerful the auxiliary modules
can come or can be when it comes down to SMB.
And of course, I covered how to use smbclient, which is
beyond the scope of this video.
But I just wanted to show you how important this information
can be when you're working within an environment that
has SMB, irregardless of whether it is Windows
or it is Linux with SAMBA.
So, again, I'm going to move on back to the slides now.
So that was a very productive session.
In the next video, we'll begin taking a look
at how to perform HTTP or web server enumeration
with auxiliary modules.