[MUSIC LOGO]
We're going to continue to look at SMB.
And in this lab, we're going to utilize a tool called SMBMap.
We have our IP address that was given to us, 10.4.26.58.
That's our target.
We will ping it.
And it looks like it is alive.
So let's run an Nmap scan.
And we get back what we would hope to expect in an SMB lab.
It's 135, 139, and 445.
We'll jump to that port 445, and we'll
run the script, tack-tack script, for SMB protocols.
And this is going to tell us the protocols
and the dialects running.
And we see there's SMB version 1 as well as 202, 210, 3.0,
and 302, with that SMB version 1 being quite dangerous.
Knowing that there is SMB version 1,
we'll go with a null session.
So we're going to utilize SMBMap, which
is a program made in Python.
And we'll go with the user of guest and a null password.
So no password.
And then, we're looking at the directory
from where we are, with the host of 10.4.26.58, our target.
And we see it connects.
And it finds all these shares, which guest is able to connect,
but only has read access to IPC and print,
which with a null session and IPC,
that's what you should expect.
It would be very dangerous if it had more access
with a guest null session.
So we'll log in with administrator and this password
that we were given for the lab, smbserver_771.
And it connects, and now we can see that we have read
and write access or read-only access in certain places.
Utilizing that same authentication administrator
and smbserver_771, now we're going
to try to run a command, this tack-x with IP config.
And we see it returns the product of that command
in the Windows environment.
It runs IP config.
And it tells us what it was.
That's potentially very dangerous,
if we can now have remote code execution
simply through connecting VSMB.
Currently, we're only enumerating,
but we can use this information later.
Let's see a list of what we've got when we connect.
This is different.
We connected.
We saw what shares we have.
And now with this tack-L, we'll list out the contents.
There's no mapped network drives.
But there are local drives.
There's a C drive and an L drive,
which is what we got from that tack-L, the list.
Kind of matched.
We saw that there was C drive and D drive there.
So this just gave us a list of them.
Now, let's connect to that C drive.
This is like running a dir or an ls.
We see what the contents of the C drive are.
In here, we see that there's a flag.txt.
We'll come back to that.
But what else can we do here?
Well, with SMBMap, map we can utilize a few different things.
Let's create a file.
So we don't have really anything here right now.
Let's touch backdoor.
And now, we have a file called backdoor, which is empty.
We're going to take backdoor, and we're
going to put it in the C drive.
So it's very much the same as our command
previously, except instead of looking
at the contents of the C drive, we're
going to use tack-tack upload with SMBMap.
We'll upload the file from our attack machine to the victim.
We'll call the file backdoor in both situations.
And now we know it's there, but let's double-check.
Let's run the same command again.
And now, we see that backdoor is there.
It wasn't there before.
But our upload seems to have worked.
It's also an empty file.
But we were able to upload a file.
And same results.
Now we see backdoor is there.
Well, could we download a file?
We know that there's this flag.txt so we'll do tack-tack
download from c$ flag.txt.
And it said it downloaded it to root.
And now we see it here.
We cat it out, and we have the contents.
So with SMBMap, we were able to connect, enumerate,
upload, and download files with some authentication.
All we needed was the username and password.
But we were still able to find some information out,
even with just the guest count.
We saw what drives were there, and we saw that there was IPC
that we could read from.
All this, we want to take in, ingest, record, and continue
the rest of our enumeration.
There were other ports out there.
Depending on the machine, there could be a lot more to find.
So we're going to continue to dig into that before we
start really exploiting.
But this file upload and file download, it's quite useful.
And we'll come back to it later.