Hello again, folks. I hope you doing
great and practice all the comments far from here. This
is actual foreign my by scripting engine part
to admiration. This is the first video from section four
and we're going to talk about and never seen be numeration.
SMB protocol. Commonly known as server message
block, particle has been lots
and a hot Target and treat actress from
many years. Because this complexity in
open Nature, this protocol was prone
to be perform of the attack from SMP, no incision
to a general blue.
Is there a reason we are about to cover the assembly
and admiration. In this video? I'm going dividend
member simbah script also known as the
nmap scripting engine and see that we talked about in the whole
section. However, the smes covered
a long journey in terms of the security hardening. He
has been updated and improved it new to the newest security
standards in a recent windows of pressure system release, I
guess the last assembly wherein
is the SME version 3.
That going to one in a Windows 10 and
Windows Server 2006. While the
most vulnerable was SM version one in Windows XP and
Windows Server 2003 because it's not a
secure history because it's not have a secret story,
always be good to Portugal for an entry accurate,
vertical axis. So with tools, like a map
is in the script. It makes it even easier to attack the performance and
we numeration and also it is not a
surprising that we still have a legacy in of
life.
Called UF operating a system running know various
public and private sector organizations a
quick query. In a chef Showdown. There
is a website for adult information gathering and
analyzing targets confirmed that there is a lots of
in a Verity of the popular publicly accessible in
a semi ports and it can be easily. Converted is
not everyone will be doing their
health. Skipping, you know think you understand Ops? Let's
Say that there's a lots and ellipse, many of
them to a hot Target to attack. So there's a
Verity of that are kids that you can test your skills on
them. So, let's see why a
similar version is important because used
to communicate over TCP IP and network that
we talk about. What is this? Epi pen before in the
previous section? As a client server protocol? Used
for file? Sharing printing say apart and
other resources on the network.
I said, we can all the other of the key and
obligations and user to access files or
exclude commenting a remote server. So a
client application, can read write and
execute phones, have the full permission. It means under
server, depending upon the configuration a mess and be sure.
Also port for smb2 445 while
one true 529 ports
are used for the RPC calls with
our Essentials for Remote Management flu Windows systems
of for sure, but she says her it is essential
to keep the target. We're trying
to Shield before animation in services. So
there's a particular case. We will getting system formation
all sessions or post shares as see. We
is like a general blue for this service.
But we're not going to cover all that smb1
rebuilding this session in this course,
actually because it's just about that and map my set assembly, but
it is a very good title if you want to
work on it and research on it by yourself. So
these opens shares, my includes some sensitive information, like
usernames, password, hashes Keys, TGC or
Etc, which can be used for different purposes and
for many purposes in your process.
So to conclude as a pair, many knowledge, we in America SMB for
many reasons, for example, non
sessions or pictures series and system
information. As, you know, and map, we are
going to use nmap for a similar Mission, but there's always other
tools, for example, SMB map, or
MP, t-- scans, and in arm for a Linux, you
can also use them for if you're interesting in that assembly. Number
ratio. So how many map has
some bees script for enumeration?
Actually, I guess there are two 25mm up,
assembly is creepy as part of sne as
a default. We will going to true to some
of them. See one of them and try one of the comments and
show you how its quirks. But there
is a lot of the comments. For example, we have smbus Discovery that's
tried to find out the computer name is Amin names, first names. If
you remember in the previous section, we talking about what
it's covers in a network. It kind of looks
like that.
That there is other comments for example, in I'm shares.
That's in. I'm going to probably exposed SMB shares if
available, of course, in addition if nmap is
not able to get shares from any husband will be
put first. Commonly used, share need to check if there is accessible. Also,
there is a in am users as
user suggested. As of course, that's
name is obvious. It is an immersion all users on
a remote operation system using two different techniques. First the
else, a brute forcing and the second one is
Samr numeration, so
you can search on a of you're interested about it. I mean, you're
going to cover it because we cannot actually
perform Patrick as penetrant testing
on the active user or active Target itself. Ethical
hacking of virtual can do that. So, of
course there's other comments, but you cannot cover some
of them. But first, let's see what comes are available in
the nmap NSA database. And
then we're going to cover one or two of
this.
Scripts, so this is the script that
we may want to work on it.
But let's first. See the assembly
database on a map and
SE. So let's go to our
lab.
So here is going to do. We're going to go to CD and
using to change our directory.
Sure. And now, as I said, this
is the path. That's usually enough scripts are available
in it. So we can easily have an access to
So, we are in it. I'm going to use LS.
Using a grip.
To find out all this and be a
script as you can see. Well, so it's
kinda the number is a 225. Maybe the
scripts here. We can see the security, more serious task
System. Info. Also some
CBE from 2017. And
also, we have a nomination groups process Services sessions
and a lots
of NSC, right? Okay.
So I'm going to clear the screen and
back to our main.
Directory. So, for example, as
I said, if you want to
Use another.
Whipped for our tryst.
And then go to our main common.
I'm going to use this one Discovery, the
say.
Cash, please. I'm gonna use a port 4005, yell.
I'm going to use this one and
the target.
So we're going to wait for the results. Going to take a while, of
course, so husband's down, so is probably it's
not how active house. So
let's just another comment and this door back
to our PowerPoint. Let's see. What come and do we use?
So this is the common that we choose to perform for you
as then be in a vision users, the
are gonna say under specific folder. We want and
go again. I'm going to click enter and here's the result
was fast the nearest record and the porter status
is a filtered of course, but the service is microphone that Microsoft HDs.
That's try to add
a user number is on it.
But now we know we saw main server plastic fruit.
So let's get back to the PowerPoint.
Well, let's have a review and summer in a video. We have a
quick brief and in providing comment talking about its what
is the useful? And what we're going to do about it? And then we use
the common in the terminal and show you the result, and how it's going to work. I'm
talking about SME, and I want a little tease and all the
possible data and you can perform an attack against
assembly servers.
The next video we're going to talk about in map and my SC. Are
you going to find out what is that? And I'm raishin. Good
luck.