Let's start with the service message block enumeration script service message block protocol is the
service that was running on Windows and using net based port which is Port 135 139 and 445.
And usually this service is very vulnerable and weak service.
So if the service is running and using net buys port which is support that I just mentioned it can be
easily enumerated and a lot of critical information can be captured.
So what we need to know to do it to need to use one of the script to test which machine may have SMB
put the code running on it and we can do that by checking the port which machine has port 135 139 running
and if so if you find if we found any machine then we can use the SMB enumeration to drop some information
like user name and group name and share name and so on.
And this would be for sure very helpful.
While we are doing the penetration testing so let's see how to check which machine has SMB services
or SMB protocol running on it.
So we can use
and map so we can type and map then minus B to specifies a port.
And here I don't have to put a specific range I can put only the port I'm looking for.
So we can put 1 3 5 comma 1 3 9 and then the range of IP is that we need to scan this specific port
on it which will be 1 9 2 1 6 8 1 6 3 from 1 2 to 54.
And then I can type minus minus open.
So what I'm doing right now I'm asking to check all the open all 135 phone 39 open port on this range
of IP and let's see what we gonna get so minus piece to specify support and minus minus open it's to
see which port are open in this range of IP
may take a few seconds because it's scanning.
Yeah.
Here we go.
So as you can see I find in the range three different host actually more than three.
So I have this machine which is uh this is the MAC address of the machine and this is the IP and we
have this IP and it got the two port open and cert and force machine.
So I have four machine that have SMB protocol on them and then I can try to enumerate uh another tool
that I can use.
It's called uh and B T scan.
So if use and beaches can let me write it down let me clear the screen
and Beatty skin this is also showing the computer in a specific range that has SMB or that used net
by a sport.
So net skin.
And then we can put the range of IP 1 9 2 1 6 8 2 1 6 2 3 2 2 5 4 and actually I'm sorry I have to put
the range not just on IP.
We're going to put 1 2 2 5 4
and betas.
Yeah.
Here we go.
Scanning.
I'm sorry.
So as you can see.
Let me rewrite it to 5 for this one.
This comment has an additional
utility which is it show you all the computer in the range that you specify that has Zenit by its port
open and it should use that MAC address.
But the most important it show you the user logged into those machines right now.
So he's going to tell is this machine are up and this user is logged in.
And this machine are up and this Ruger user is logged in.
So you'd get to know a user name.
So now I know that this computer is vulnerable and has this SMB service that I can first enumerate to
get some additional information.
Second I can try to compromise this machine which will not be that hard since it got SMB and got net
net by this port open.
And then I also was able to get a user name from this machine so I can use it for try to crack the password
and try to get this user name password as you're going to see later on.
So those are some tools that allow you to identify as SMB enumeration.
So since I know that there is some machines that may be infected users and b enumeration be cool because
their net bios port are open.
I can try.
I can now try to enumerate and get some machine from I'm sorry get some information from this machine
due to it's infected with the SMB enumeration.
Let's see how to do that.