Now that we understand what SMB is,
we'll get into how to actually enumerate it.
Now this is the real meat and potatoes
of what we're trying to get after.
We're going to utilize some Nmaps scripts in order
to actually find some information out
from this service.
Now that we know it exists and that it's on the system,
what can we do with it?
What can we learn from it?
That's what enumeration is.
You find a service from port scanning.
Now, what do we do with it?
What can we learn from it?
We're not going to exploit it yet,
but we want to gather more information.
Nmap has a scripting engine.
It's a bunch of scripts that have
been written that work alongside what we've already utilized.
So we're going to take advantage of those.
You can find a bunch of information on the Nmap website
or within the documentation.
And I'll show you some examples.
So we have an IP address, this 10.4.31.90.
It came with this machine.
So we'll ping it.
And it looks like we've got a good connection.
That's good.
That means it's live.
We'll run an Nmap scan.
And it's kind of what we would expect 135, 139, NetBios
and 445.
I'm guessing it's a Windows machine
and it looks like it's got SMB.
So now we're going to add to our Nmap scan.
We're going to look only at port 445 because that's the SMB one.
So we don't really need to run these scripts against anything
else, so run it just on 445.
Then we'll look at the SMB protocols.
This will tell us what protocols and dialects that it's using.
And this is helpful because it's basically versioning
information, if you will.
So it's got NTLM 0 and 2, otherwise known
as SMB version 1, which is dangerous.
But it's the default version.
Now, you might have heard of WannaCry.
There's a lot that takes advantage of this SMB version
1.
And there's a good reason why it's not used anymore.
It's dangerous, but it's default.
So this is a misconfiguration that we could utilize
or the criminals could utilize.
So let's look at the security mode.
There's a script for that.
The way we enter these scripts--
kind of blew past that--
is tack, tack script and then the name of the script.
Again, this is all in the documentation.
Or you can go and look at the thousands
of scripts that are included.
But looking at the documentation is most useful.
And we can see that it's got a guest account
that authenticates to a user and message signing
is disabled, which is dangerous but, again, a default.
Default configurations usually get people in trouble.
That's why auditing and vulnerability scans and pen
tests are useful to point out things that people miss,
that are default but dangerous.
So how is this guest account useful?
We'll do this SMB enum sessions.
And we'll enumerate the sessions.
And what we'll find is that Bob has been logged in as a user.
And since we didn't pass any information, we kind of--
we also had Nmap log in as a user
and see who else was logged in under that guest account
because we didn't pass any username or password.
Let's try it now.
Again, enum sessions and we'll pass script args.
So after your tack, tack script, you
name the name of the script, and you pass arguments, tack,
tack script, tack args.
And in this case--
again, it's going to be in the documentation what
these things are--
we use SMB username administrator and SMB password,
SMB server 771, our IP.
Let's put it all on one line and add in this guy,
give it an IP address.
And so now we saw Bob logged in.
And we can even see the time that he
was logged in as a user.
And then we've got an active session as administrator
connected from 10.10.3.2 which should be us.
10.10.3.2 just logged in.
And that even tells you it's probably you idle for not idle.
So with that, enum sessions passing a username
and password, it authenticated and pulled the session
information.
Now let's enumerate the shares.
We've seen how a share normally works.
You can go in and configure a drive
to share in different ways.
We want to see how this one is configured.
Do we have access to everything or what is the breakdown?
This one's going to take a little bit longer because
rather than quickly logging in, logging out,
it actually needs to pull a bunch of information.
We have our results.
In here, we can see account used was guest
because it used that default guest account that was allowed.
And it doesn't find a whole lot.
This is hidden for admins.
It's not going to tell us much.
The C drive exists.
There's a documents.
There's downloads.
There's this one, IPC.
IPC is useful.
That's a null session.
So a null session is like an anonymous session.
Not only could you get in as a guest,
but you can utilize this null session, this IPC.
Looks like there's also prints.
It's very common for us to be-- well,
it is a use of SMB to share printer information.
This is how the printer can print to or print
from different machines on the network
or scan in two different machines on the network.
So now let's enumerate the shares after authenticating.
And we have our results back.
You see it's a little different now that we're authenticated.
We use an administrator account.
And we see admins.
We see the path, if you will.
We saw that C drive.
We see what our access is.
We can read-- in the actual C drive we can read and write.
This can be very useful.
But, again, that IPC is there and anonymous access is none.
Our current user access is read and write.
If we went back, IPC anonymous access was none,
but the guest account had read and write.
And it's very, very good to know.
As an authenticated user, looks like
you can read and write in most of the places you would expect.
Now we're going to enumerate the users.
So let's see which users exist.
We get our results back.
There's administrator.
There's also Bob and this guest account.
It tells us that the guest account's
a built-in account for guest access, which is dangerous.
We got some flags here.
Password doesn't expire.
Password's not required.
And it gives you a normal user account.
It's a misconfiguration.
This is something you would want to write up as a finding.
Thinking like the adversary, this is the sort of thing
that you'd want to see, OK, what else can I learn?
What can I take away from this finding?
Now we'll look at the server statistics using the server
stats script.
And we'll authenticate.
A lot of this remains the same.
We just change the script we're utilizing.
And this is useful.
We can see how much data was sent and received,
how many failed logins, permission errors, if there's
print jobs or files open, some--
a lot of information together remotely.
We can see what domains exist here.
And it never hurts to gather as much information
during the enumeration phase as you can.
It's better to come back later and try to figure out, OK,
was this useful or not?
But while you're enumerating, find out
as much information as possible.
You don't know what's going to be useful and what's not.
You won't be able to figure that out
unless you gather information.
So in this domain, we can see the groups.
We can see users.
We can see some password information.
There's no min length.
There's no min age.
There's no history settings.
That's all weak configurations.
There is complexity requirements.
So if we were going to throw a brute force word list at this,
we might need to think about how all that ties in.
And that applies to this--
WinRM remote WMI users.
So we will get into that later.
That's the users.
Now let's look at the groups.
Groups are helpful, break up users into different levels.
So we can see our administrators include administrator and Bob.
Bob might be easier to get into than the administrator
and still exists on the administrators group.
So it should have all the same powers, all the same access.
We can look at what services are running.
And we're getting all this from SMB.
Even though it's not always specific to the service,
in this case, yes, it is.
But we can gather a lot of information.
And we can parse through it later and figure out
what's most useful.
We can see what services are running just
by going through some Nmap scripts.
This one is a little more useful.
Not only would we see what shares exist,
but it's going to run the script SMB enum shares and also
SMB tack ls.
So, in this situation, it's going
to connect to SMB and run ls, or the list command in Linux.
It's similar to dir in command line on Windows.
And it'll tell us what's actually
in each of these shares.
So not only will we see the overarching directories
and folders, we could see what's inside those folders.
That scan took a little bit of time to run,
but there's good reason.
It enumerated the shares.
But then, looking inside each share,
we can see inside of admin there's some more directories.
I don't know exactly what those mean, but it could be useful.
Inside C, we can see common files and explorer,
some useful stuff.
We see that there's PowerShell, as we might expect.
Nothing in documents or downloads.
There are some files in print, kind of useful.
And in those same files in C are in C$.
We don't know what's useful and what's not useful
unless something jumps out at you.
But that's how we can enumerate SMB utilizing some Nmap scans.