Hello and welcome to
another application of the minor
attack framework discussion
today we're going to get into a
case study for discovery.
And so in this case study, we're
really just going to touch on a tool
of the trade and give you an idea
of some of the things that are out
there that a threat act or even a
standard user could just get and
use with no license,
no need to pay for anything, just
a simple download and a really
robust and awesome tool
to use, whether you're a network
administrator, whether
you're a penetration test or a
security analyst, a
an auditor looking to validate some
system information, I
want to introduce you to the
power in MAP.
And so if this is your first time
hearing about MAP, unfortunately
this is not a full
fledged course on in
map. We're not going to get into
nitty gritty details.
I'm just going to give you an idea
of how two particular scripts
within in MAP can provide some
pretty awesome information about
systems.
And so one of those is going to be
the SMB enum users
for innumerate users.
And the script output is simply what
I got from the EMAP site,
but it gives you the following
results.
And so it will do the enumeration
of users.
It provides you with the account
information.
It's got the system name over
here and then it's got
another account here.
It gives you a bit of a description
about the account.
Any a password flags on the account
like that. It does not expire
in both of these cases.
This one says password is not
required.
It looks for this
one also doesn't expire and it's a
normal user account.
And so just by running this one
script, if we were able to,
we could also see a number of
the other accounts
that were involved here, as well as
it would have gotten into descriptions
down below. So this is a great
bit of output.
If I were a threat actor and I got
on some super users computer
and they happened to have a map
already on it one, it's awesome
because I've got an administrative
account, but two, I can run some
scripts straight from EMAP
and potentially get details
if I don't already have my scripts
there and ready to roll.
Another example of this is OS
Discovery, which can be done with
MAP as well.
Now it can be hit or miss, but it
is the Sambo's Discovery script
and it outputs things like
the server version
down to.
Service pack information, which is
great, because if I need to
know
what particular exploits will be
available for this, I can go
straight to the type
of operating system the service
packet installed.
It looks like there's some
additional information here that may
be pertinent to me understanding
what's going on here, like there may
be some actual information
going on or there may be actual 2008
running on this system.
So further helping me to narrow
down what this system could be,
what the value of the system is.
Now, the system time here is
all because, again, I got this
from the site, but I'll have the
name of the system, the domain
information I've got
version information service pack
information. All of this is
pertinent to helping me to
understand what I could potentially
do to that system to get further
access or whether or not the system
would be of value to me.
Now, this is just one of many tools.
And so I encourage you, if you've
never heard of EMAP and you're
interested in learning more,
I believe you can just do a quick
Google search for Map and their
site. They've got a full PDF version
of their manual going through all
the different things that it can do
and its capabilities.
And there are also full fledged
courses here on Siberry that
could assist you in getting very,
very detailed in some of the use
cases for and map.
So with that in mind, I want to
thank you for your time today and
I look forward to seeing you again
soon.