[MUSIC PLAYING]
Enumerating network information on Windows.
In this video, we're going to be exploring
the process of enumerating as much information as possible in
regards to networking.
So what are we looking for in terms of information?
Well, firstly, we need to identify the current IP
address of the target system, which we pretty much should
have already obtained if we are exploiting it.
But we want to learn more about the actual network
configuration, as well as the network adapter,
and information like the actual gateway
of that particular adapter.
So we are trying to identify what host
or what IP address on the network
is responsible or is actually fulfilling
the role of the gateway.
We also want to identify any internal networks that we
couldn't access publicly.
So we want to know whether this system is
part of an internal network that we can then
scan for to identify other hosts on that network
that we can pivot to.
We also want to identify the TCP UDP services that
are running on the target system,
as well as their respective ports.
And of course, we also want to be
able to identify other hosts on the network.
We are also interested in the routing table, which
will shed light on any specific routes that look interesting,
as well as the current routing table.
And of course, we also need to identify or get
an understanding of the current state of Windows Firewall--
whether it's enabled, whether it's disabled.
And all of this information is really
important for various reasons.
More specifically, it's really important during the pivoting
phase of post exploitation in that we are essentially
trying to identify whether the most important pieces
of information that we're trying to identify
are internal networks or whether we can identify
other hosts that are part of that network
that we can pivot to.
And also, in the case of Windows Firewall,
that can give us an idea of what we can and cannot do in regards
to targeting specific ports.
So again, this is also incredibly important,
especially during the pivoting phase.
So enumeration is essentially setting up
the stage for the other phases of post exploitation.
With that being said, this video has a lab environment
attached to it.
We're going to be using the same lab
environment we've been using during the Windows
Local enumeration section.
So all you need to do is just fire it up,
and we can start off by gaining access to the target system.
And then, we can take a look at how to enumerate
network information.
So I'll be seeing you within the lab environment.
All right, so I'm back within the lab environment.
And like the previous videos in this particular section,
we are provided with the target IP address.
Of course, in your lab environment,
the target IP address is going to be different.
But we know what vulnerable service
is running on the target.
So we can open up a terminal and we can open up Msf console here
and load up the exploit module for the Rejetto HTTP file
server that's running on the target system.
And that will consequently provide us
with a Meterpreter session.
So I'll say, search Rejetto.
And we can then say use 0.
Set the target IP, so set RHOSTS.
And we can then type in exploit, and that will provide us
with a Meterpreter session that we
can use on the target system.
So we'll give this a couple of seconds.
All right, fantastic.
Now that we've obtained a Meterpreter session,
we can open up a command shell session.
So I'll just open that up there.
And let me just zoom in, so you can see what's going on.
So the first piece of information
is, of course, going to do--
or going to be our current IP address
and information pertinent to the network adapter or the network
interface card that's been configured on the target
system.
So in order to get that information,
we can type in IP config.
So IP config will tell us the current adapters
connected to this system.
In this case, there's only one adapter,
and that's the ethernet adapter.
So it'll tell us the DNS suffix, and then,
of course, the IPv6 address, the IPv4 address, which we already
had right over here.
And then, of course, the subnet mask,
which gives us an idea of the network range
and the amount of devices or hosts that are likely to be--
or rather, the maximum amount of hosts that
can actually be on this particular subnet.
And then, of course, we have the default gateway.
So the gateway is essentially--
if you think of it from a very basic point of view,
this is the system or the router that's
responsible for routing all the traffic to the various hosts
or devices that are on this particular subnet.
And then, of course, you have the tunnel adapter,
which is just specific to AWS.
Now, we can get additional information
regarding the current adapters by typing in IP config all--
so ipconfig/all.
And you can see that this will provide us with the Windows IP
configuration.
So the Host Name, the primary DNS suffix,
the IP routing functionality, which is currently disabled.
And then, of course, for the Ethernet adapter,
here, we also get the Mac address,
which can be used for if you're performing network pen testing
attacks that essentially involve a Mac address
or trying to spoof a Mac address.
We can see that DHCP is enabled, which
means that on this network, IP addresses are assigned
automatically by the gateway or the device
responsible for that.
So if there is a DHCP server, then it's,
again, responsible for assigning IP addresses.
This is very important, because it tells us
you know that hosts or devices on this network
do not have static IPs and are likely to change.
So do keep that in mind.
We get the IPv4 and IPv6 address.
And of course, we can see that in the case of DHCP,
it tells us when the lease was obtained and when it expires.
So whenever you connect to a DHCP-enabled network,
you're provided with a lease for a specific IP address.
In this case, the IP address, as we know, is this one here.
So what's happened is the DHCP server
has told this device that you obtained the lease
on the following date.
It'll then expire on the following date.
At that point, you will either be assigned another IP address
on the network or on the subnet, or you
can continue using this one if there aren't any conflicts.
So we have the default gateway and the DHCP server.
So you can see that the DHCP server and the gateway
are the same, which is very common in small networks.
And then, of course, you have the DNS server,
which again, is something that's very, very important.
So that tells you what the DNS server--
this system-- is utilizing for requests or DNS lookups.
And of course, right of your NetBIOS over Tcpip
is set to enabled, which in this case
is really pertinent to Windows and how NetBIOS is configured.
You also get additional information
regarding the other adapters.
Now, if this particular system was connected
to another network or was part of an internal network
that we could not access publicly,
we would be able to get that adapter information.
And we could, in the case of pivoting,
we could add that route so that we could essentially
gain access or scan that internal network
through the system that we've just exploited
as it is part of that network.
All right, so that is how to display the current adapter
information or the network interface card information.
And as I said, all of this information
is really important during pivoting.
And of course, we'll be exploring that.
We can also display the routing table.
So we can do that by saying route print.
And in this case, it'll not give us
any other additional information apart
from what we already know.
So for example, the gateway for this particular subnet
is set to the address.
And we were able to get that earlier on.
There we are-- so the default gateway.
And this will tell us whether we have any other active routes
that might be interesting.
And in this case, there aren't any interesting routes here.
Then, that makes sense.
And yeah, so if you want to actually display
the routing table, you can do that by typing in route print.
All right, now, if I wanted to discover
other devices on the network, which is very, very important--
so for example, if I exploited this system, which we have,
and if I wanted to see what other systems are
available on this network, I could do that by saying arp a.
So arp-- we're using the arp protocol, and we're saying a.
That'll display the arp table, which
essentially has a list of all devices on the network.
In this case, you can see that we have the--
it has the address, as well as the Mac address,
of the default gateway, which is, again,
responsible in this case for DHCP, as well.
We also have another IP address, but this
is pertinent to the actual subnet mask.
And we have a couple of other ones
here, like this one here, which is interesting.
You can see that that IP address right over here
has the following Mac address and is dynamic.
And the rest of them are pertinent to the subnet mask
right over here.
So this would, again, give us an idea of what other devices are
on this particular subnet here.
And in this case, the only other device
that that's part of this subnet is this one right over here.
This looks to be an external IP address, which,
again, we can also target.
But again, this is very, very important.
So this information, again, will come in
handy during the pivoting phase of post exploitation.
Right now, if we wanted to display
a list of open connections or the services that are currently
running and the ports that they're running on
on the target system, we can do that by saying netstat ano.
This will display a list of services that are currently
running or listening.
So in this case, we can see that we have Port 80 and then
the rest of the typical Windows protocols
that are all running here on TCP.
So the way the information is sorted
is you have your protocol, the local address,
the foreign address, if a connection has
been established, the state, and the process ID.
So this is very, very important, because right over here,
starting off with these ones, these are the services that
are running on the target.
So you can see there have been binded to the target system's
IP address and can be accessed from the local host
or the system's external IP address or public IP
address, for that matter.
So we can see that this will pretty much give us
the services that we would have identified with Nmap.
So we have the HTTP file server running on Port 80.
We also have NetBIOS and SMB.
And then, of course, all RDP and a few other Windows Services
running and their respective ports.
Now, one additional-- or the additional information
that's really interesting here is this right over here.
So in your case, you'll be able to identify
a service that's currently connected to Port 4444.
So that the foreign address.
So this is the system that is connecting
to this particular port on the target IP
or on the target system.
So you might be asking yourself, why am I pointing this out?
Well, this is our Meterpreter session.
You can see that the connection or the state is established,
and the process ID of this connection is 2540.
So you can see that this is the actual listener
or the reverse handler of our Kali Linux system,
and this is the IP of the Kali Linux system.
So we can see that the system right over here--
because this is a reverse shell--
the target system has connected to our Kali Linux
reverse handler on port 4444.
And the state is established.
So that gives you an idea--
that'll give you an idea of--
this will really give you a good idea
of what services are currently running
as well as established sessions.
So for example, if we connect it to the target system via RDP,
that would actually be displayed here.
And again, it gives you an idea of what's running,
as well as what network sessions may have been established.
So do keep an eye on that.
And if we take a look at some of the other ones here,
you can see that, again, this will just
display the services that are currently blinded to the target
IP address.
And at the bottom, you have the UDP ports.
So you can see that we have UDP Port 135 running or open,
3389, et cetera, et cetera.
And right at the bottom, for the case of UDP,
we also have the IPv6 address specified here.
So again, this gives you a good idea
of what's running in regards to network services as well
as their protocols.
And it also displays important information
like established network sessions
or the ports being utilized by specific services or protocols.
And in this case, this is a Meterpreter session.
Right now, the final piece of information
that is very important is the actual Windows Firewall
configuration and state.
This can be displayed by saying netsh.
And let's start off by saying by enumerating the firewall state.
So I can say netsh firewall show state.
We'll give this a couple of seconds.
Right over here, you can see that in some cases on newer
version of Windows, it'll tell you that netsh firewall is
deprecated.
So in that case, you then want to utilize
the netsh advanced firewall firewall.
So in this case, we can say netsh, advfirewall, firewall
state.
And let me just modify that.
So we can say netsh, advfirewall.
And let me just display the commands
that you can run with this.
So I'll just type that in.
So we can specify the firewall itself.
So I'll say netsh advfirewall, firewall.
And let's see the commands that we can type
or we can use in regards to the actual firewall.
So in this case, we can actually display the specified firewall
rule.
We can set new values for properties,
or we can configure new firewall rules.
And we can essentially display--
we can also open up the Help command
or utilize the Help command.
So we'll say netsh advfirewall, and we can then
say firewall help.
And that will display the following command.
So let's just run this.
And I'll just copy that there.
And instead of saying help, we can now say, for example, dump.
And in this case, we don't have any configuration script.
So we can say, show.
And that'll require us to specify a specific firewall
rule.
However, if we want to display the state,
we can essentially display the state
by saying netsh advfirewall, and then we can say,
show all profiles.
And in this case, it looks like the Windows Firewall service
is disabled and not running.
So that tells us whether or not the Windows Firewall
is running.
And in this case, it looks like it isn't running.
So again, we can utilize the documentation or the Help menu
for adv firewall.
So I'll just hit Enter.
And you can see that in this case,
we can, again, make changes to the firewall using
netsh advfirewall, firewall.
And in this case, what we did is we
essentially showed all profiles, which would essentially
display all firewall rules.
But in this case, we can see that the Windows Firewall
is disabled.
So again, that can be very useful in trying
to identify whether specific ports have been blocked.
And again, all of this information
is useful if you're trying to utilize a specific port
or you're trying to set up a listener, et cetera, et cetera.
All right, so that is going to conclude
the practical demonstration side of this video.
All right, so now that we've explored
the process of enumerating system information, users,
and groups, as well as network information, in the next video,
we'll be exploring the process of enumerating service and task
information.
So we'll be trying to identify a list of running
services on Windows, as well as scheduled tasks,
and essentially, trying to get an idea of what
is running on the target system from the perspective of tasks.
And again, that is important for its own reasons
that I'll be stating in the next video.
So that's going to be it for this video.
And I will be seeing you in the next video.