[LOGO EFFECT]
Targeting SMB.
In this video, we're going to be taking
a look at the various tools and techniques
that we can use to exploit SMB to consequently provide us
with remote access to the target system.
So we're going to be exploring various tools and techniques.
So it's going to be quite lengthy,
and I'll be covering some very important techniques
that you should be performing whenever you're targeting SMB
running on a Windows system.
Now, I've already explained SMB quite a bit
or gone through how it works in the system
and host-based attacks course.
So if you want to learn more about SMB and how it works in
regards to authentication, you can check out that video.
So again, we're using the same lab environment.
If you have terminated it and you start up a new lab
environment, remember to get the new target IP address
as it changes.
And of course, also take note of the fact
that whatever information you're gathering,
like user credentials and passwords,
should be saved within your own note-taking application,
as any data that's stored within the lab environment
will be deleted or wiped once that lab is terminated.
With that being said, I'm just going
to switch over to my lab environment,
and we'll take a look at how we can target SMB in order
to gain access to the target system.
So I'll see you there.
All right.
So I'm back in the lab environment.
And I've just performed an Nmap scan on the target system
on port 445, which is the default SMB port.
And I've performed a service version detection scan, as well
as the default Nmap script scan.
And again, this information we've already gone through.
We've been able to identify the target operating system.
We know it's Windows Server 2008 R2, build 7601, service pack 1.
And we do know that from the actual host script results
right over here, we do know the host name of the system,
as well as the various SMB security configuration
for both SMB and SMB version 2.
With that being said, we also need
to take into consideration the information that we've
been able to gather so far.
And one of the most important pieces of information
we were able to obtain within the previous videos
was the two user accounts, as well as their passwords, right?
So we were able to obtain two user accounts.
One of them was administrator.
The other one was Vagrant.
And we obtained the credentials for FTP, as well SSH.
And as I mentioned, with regards to those services,
those are your--
those services utilize already existing user accounts
on the Windows system.
So we do know that we have a Windows
user called Administrator and another Windows user
called Vagrant.
And via-- through the SSH video, we
were also able to identify that the credentials
or access to the system via SSH with the administrator account
has been blocked, even though the actual password
would have worked.
But we were able to gain access via the Vagrant user.
So we'll be using all of that information to essentially
perform our SMB attacks.
Now, if you have not been able to identify any user accounts,
and of course, this is in reference to other pen tests
that you will perform, then you can perform a brute force
in order to identify the usernames, as well
as the passwords.
But what I would recommend doing is, firstly,
identifying usernames so that you can narrow down
your brute force attack.
And of course, in the context of Windows,
we know that there's always an administrator user.
So what I would typically recommend doing
is performing a brute force attack with Hydra
for the administrator user account
in order to try and identify the password for that account.
So to perform a brute force attack with Hydra on SMB,
we simply type in hydra and the username we are testing
or we are performing the brute force with
is the administrator user account.
We can then specify the password list or the word list
containing the passwords that we would like
to use for the brute force.
In this case, we can use one under the user share wordLists
directory.
So usr/share/wordLists.
And under the Metasploit directory,
we can use the Unix, users, wordLists.
So we can say unix_users.txt or passwords.txt.
It's entirely up to you.
And we can then specify the target IP address, which I've
already obtained in this case.
So I'll just copy it again, make sure I have it,
and I'll paste that in there.
And then you specify the protocol
that you are performing the brute force attack on,
which is, in this case, is SMB.
Now, I've already covered SMB brute forces in the system
and host-based attacks course, and all
that can be done via the Metasploit framework.
But again, if you want to do it with Hydra,
that'll work out just fine.
So I'll perform the brute force attack.
And you can see we're able to authenticate successfully
with SMB with the administrator user account,
and the password is vagrant, as we
were able to obtain previously during the FTP section.
So now that we've obtained legitimate credentials,
we can, of course, also test the Vagrant user,
and let's see whether we're able to authenticate
as well, because both of these are actually Windows accounts.
So we can say vagrant.
Let me type that in correctly.
So vagrant and I can hit Enter.
And the password should indeed be vagrant.
There we are.
So what can we do with these credentials?
Well, for one, we can authenticate
with the target via RDP because if you remember during the port
scanning and enumeration video, we
identified that we have RDP running on the target.
So we can immediately authenticate
with the target via RDP.
However, we are focused on SMB exploitation, right?
So again, we've obtained credentials.
The next logical thing would be to enumerate any shares,
and enumerating shares can be done without credentials,
or in the case of--
if in the case you actually have legitimate credentials,
then you'll be able to obtain a lot more information.
So one of the tools that we can use, for example,
is a tool called smbclient.
Right?
And we can list out the actual shares,
and we can authenticate with the use of Vagrant, for example.
So I can say vagrant, and I can hit Enter,
and we'll type in the password for vagrant.
There we are.
And we get the shares.
However, in the case of SMB client,
it looks like the connection failed,
and it is unable to connect with SMB version 1.
So that's perfectly fine, but primarily
because we're not really interested in shares,
and there isn't any information available within the shares.
But you can see we have admin and C and your typical--
your standard IPC share.
We can also use SMB map.
That's another tool that is quite useful.
So smbmap, and we can authenticate
with the use of vagrant.
So we say username is Vagrant, and the password
is vagrant as well.
We then specify the target IP using the hyphen or minus
capital H and the target IP.
We hit Enter.
And again, that will enumerate the shares
that we were able to identify previously with SMB client.
Now, another important thing that we can do
is enumerate other user accounts on the system
with the credentials that we already have,
and that can be done through the enum4 Linux tool.
So we can say enum4linux.
And we can authenticate with the target.
So we can say the password or the username is vagrant,
and then the password is, again, just going to be vagrant.
And we are connecting to the following IP.
So that will allow us to enumerate all the other user
accounts on the system, and indeed, you
can see that these are the other user accounts.
So we have the administrator.
And then the rest of the user accounts were created,
and these are just your Star Wars names
right over here that we created just
to showcase this particular technique.
So you can see, we have vagrant, sshd_server, sshd.
And then, of course, Luke Skywalker, Darth Vader,
and the administrator, user.
So once you've obtained legitimate SMB credentials
or credentials for user accounts on the system,
you can learn a lot more about the system.
But this is just basic enumeration.
And again, I recommend saving all of these user accounts.
And of course, in the context of a real penetration test,
then all of this information should be logged.
All right.
We can also enumerate shares with a Metasploit framework
module.
So I'll just open up MSF console here,
and we'll take a look at a few modules
that we can use in the context of SMB.
One of which is the SMB enum users module.
So I'll search for it here.
So smb_enumusers.
And we can also enumshares, but we've already done that.
So let's take a look at the enum users module.
So enumusers, and that's we're going to use this module here.
So I'll just say use and the ID of 1.
Well, that module there.
In terms of the options-- because this will typically
require legitimate credentials, we
need to specify the target IP.
So I'll say set RHOSTS, target IP, and then set SMBUser.
So we can do this with either the Vagrant account
or the Administrator account.
So we can just use vagrant in this case,
and the SMB password is just vagrant as well.
So SMBPass vagrant.
There we are.
And we can then hit Run, and that will enumerate the users
that we were able to enumerate with enum4 Linux.
And of course, you can also enumerate shares
if you want to, but that's really not what
we're interested in.
So you might be asking yourself, well, we've
already obtained legitimate user account credentials.
We can log in via RDP.
But what else can we do?
Well, we can utilize a tool called psexec
and more specifically the Python implementation of psexec.
And again, in the case of this lab environment,
we can locate the file.
So psexec.py and it should be under the usr/share/doc/python3
impacket/examples directory.
So we can just copy this file onto our desktop.
So I'll just navigate into desktop, and I'll say copy.
And we'll copy it into our current working directory
right over here.
OK.
So psexec is a tool that allows you
to authenticate with a system remotely via SMB
with legitimate credentials.
Now, in order to use it, you're going
to require the target IP address, as well
as the legitimate credentials.
So I'll just copy the target IP there,
and I'm just going to paste that in here
because it's quite important in this case.
So to utilize psexec, we can say chmod plus x to essentially
make it executable.
So chmod plus x psexec.py.
And then we can launch it with Python 3.
So psexec.py, and then specify the user
that we would like to authenticate with.
So in this case, administrator because we got the password
for the administrator account.
We can then paste in the target IP.
So we're logging in just like you would SSH.
We hit Enter.
It's going to ask us for the password.
In this case, we know it's vagrant.
And it's going to request the shares.
Find a writable share, and it's then going to upload a payload
and then provide us with an elevated command prompt session
here because we logged in with the administrator account.
So I can say who am I, for example, and the authority
system, which is the highest level of privileges
available on a Windows system.
So we've been able to gain access via SMB,
and this is our second attack vector
that has provided us with access to the target
system, one of which was SSH.
And in this case, in the case of SMB,
we've been able to authenticate with the Administrator user
account, consequently giving us elevated privileges
on the target system.
So the lead pen tester should actually
be giving you a lot of credit for this, if you actually
were able to do this without watching this video.
So that's how to utilize the psexec Python script.
Now, the Metasploit framework module
also has a psexec module.
So I can just terminate this here,
and we can open up MSF console.
And we can search for it.
So we'll give this a couple of seconds.
There we are.
So I can say search psexec.
And this also requires credentials.
And the one we're looking for is this one right here,
exploit/windows/smb/psexec.
And that is the Microsoft Windows authenticated user code
execution module.
So we'll say use 4--
or actually, let's go back here.
So search psexec, and I want to use 4 not 3.
And there we are.
So the default payload is windows/meterpreter/reverse_tcp.
We know that the target is running a 64-bit version
of Windows Server.
So we can set the payload to Windows.
windows/x64/meterpreter/reverse tcp.
So that will provide us with a 64-bit meterpreter session.
And if we show the options, we again
need to set up the username and the password,
as well as your LHOST option and your LPORT option here.
So you need to set this to your Kali Linux IP.
And for the port, make sure you set that
to a port that's not currently being used.
So we'll set the RHOSTS option.
So that's the target IP.
There we are.
And we'll set the SMB user to administrator.
And I'll just change that to a capital A
because this module usually has a few issues.
And then we say set SMBPass.
There we are.
And we can set that to vagrant, and we can then exploit.
And this should provide us with an elevated meterpreter
session.
All right.
So it looks like it's working.
It sends the stage, and we get a meterpreter session
on the target system.
So I can say sysinfo, and you can
see it's running Windows Server 2008 R2, getuid, NT AUTHORITY
SYSTEM.
And we can enumerate our privileges by saying getprivs.
And there we are.
So again, you can utilize both-- you can gain access
to the target system via SMB with psexec both manually
and automatically.
And that's something that I really
wanted to highlight because you don't
need to rely on the Metasploit framework or the manual Python
scripts like the psexec Python script.
All right.
So that is how to gain access with the credentials
that we've been able to obtain.
Now, what if we did not have any SMB credentials?
We were able to identify that the target is running Windows
Server 2008, and Windows Server 2008 and Windows Server 2008 R2
are both vulnerable to the EternalBlue vulnerability
or exploits.
So that means that we can discount whatever
we've done so far in regards to getting legitimate credentials,
and we can gain access to the target system
without knowing anything apart from the SMB port
and the target IP with the EternalBlue Metasploit
exploit module.
So I'll do that right now by saying search eternalblue.
And we can use the first one.
So that's exploit/windows/smb/ms17 010
eternalblue.
And I'll say use 0, and the payload
is set to the default 64-bit meterpreter payload.
So I'll say show options.
And you can see, in this case, we only
need to specify the RHOST option.
So set RHOTSTS.
I'll specify the target IP.
And now, we also need to set up the target information.
But in this case, we'll leave it as automatic
because this module does detect what version of Windows
is running very, very well.
So will it exploit?
You can see that it's going to tell you right over here,
the host is likely vulnerable to the ms17_010 vulnerability,
and it's then going to essentially perform
the exploit, and it should send the stage
and provide us with a meterpreter
session on the target system.
The great thing about the EternalBlue exploit
is that irregardless of whether or not we have credentials,
it will provide you with an elevated meterpreter
session right out of the box.
Right?
So if I say sysinfo and getuid, NT AUTHORITY SYSTEM
without having done whatever we have done previously in
regards to obtaining legitimate credentials,
and then using those credentials to perform
remote command execution or authenticated remote code
execution.
So that is how to target SMB.
As I said, you don't also have to rely on the Metasploit
framework in regards to exploiting the EternalBlue
vulnerability.
You can also utilize the actual exploit code from ExploitDB.
The only reason why I haven't done that
is because this lab environment doesn't have access
to the internet.
And one of the actual ExploitDB EternalBlue exploits
requires you to download shellcode and utilize
that in conjunction with the actual Python script.
But that's something that you can try out as well.
As I said, I don't want you to rely
on either manual techniques or automated techniques alone.
You must be able to essentially perform or use them both
and synthesize whatever you are doing
in regards to testing or to using both manual tools
and automated tools.
With that being said, that is going
to conclude the practical demonstration
side of this video.
All right.
So now that we have taken a look at how
to exploit SMB and consequently gain
remote access to the target system,
we can now move on to the next attack vector or the service
that we will be targeting, and that, of course,
is going to be the MySQL database server.
And we're going to be taking a look at how our access
or how we can gain access to the MySQL database server
and what that means for all the web applications that
are currently being hosted on the target system
and how we can utilize our MySQL access to essentially modify
web application data or web application customer data
that's being stored within the actual MySQL database.
All right?
So I'll be seeing you in the next video.