[MUSIC PLAYING]
We've now looked at Windows SMB utilization.
We're going to change the pace a little bit
and get into some Linux utilization of SMB.
It's going to look very similar.
We'll also introduce a couple more tools that you
can add to your toolbox.
So we're getting our IP address.
We're going to be on the same CIDR 24 with the .3
instead of being the .2.
So that's going to be our target.
And we see 139 and 445 are showing.
And we didn't run a service enumeration.
We just ran a port scan.
So this column right here-- it goes
with what it's guessing the service is,
based on the known port.
So it says, microsoft-ds and netbios.
But if we ran an actual service scan on 139 and 445--
let's try that without the space.
But it even chose here for 139 Samba 3.X to 4.X
And we've got a workgroup of RECONLABS.
So just by connecting, we get this host information--
SAMBA-RECON as part of RECONLABS as the workgroup.
So we get some information about the machine.
We could add that to our enumeration, our mapping list,
if you will.
What else could be in this workgroup?
What are the other hosts?
So now we've gotten a little bit of that information.
We go a little deeper on that because there's also a UDP.
So we'll do the -sU.
And if you don't do --top-port with this,
then it's a much longer scan.
So we'll just do --top-port, top 25.
And I'm going to do that with a --open,
though it only displays the ones which are open,
even if they're open or filtered.
If it knows that the ports are closed--
and I don't even want to see those--
normally, it'll show them.
And UDP does take a little bit longer.
So we have the longest part, and again, it's
showing netbios, but 137 and 138.
We could do a service enumeration on that as well.
And our scan results are back.
We see that Samba with RECONLABS again.
And 138 is showing filtered, but we
have the same information, SAMBA-RECON, just
on the UDP side.
If we go back, looking at just port 445,
we can then run some scripts.
We want our smb-os-discovery script.
We've run that previously.
I want to see what it gives us.
It's going to give us the version of Ubuntu,
or the version of Samba, 4.3.11.
Even though it says Windows 6.1, it knows what it actually is.
We've got the computer name, which is victim-1,
and the NetBIOS computer name, which is SAMBA-RECON.
Now, a tool we haven't gotten into yet
is msfconsole, or MetaSploit Framework, which is MSF.
The Metasploit framework is--
it's actually a whole bunch of tools-- it's
a framework-- all combined.
Sorry, I'm massively zoomed in, so you missed out
on all the ASCII art here.
They're all known for their ASCII art.
But it's a bunch of tools all put together.
You can see there's 1,882 exploits over a thousand
auxiliary modules, a bunch of post modules, tons of payloads.
There's evasion.
There's nops.
When you start getting advanced, Metasploit is your friend.
We're going to use an auxiliary module.
Tab completion also helpful.
Be curious what you need to add.
Show options shows you all your options.
We've got a requirement for THREADS in this Required
column.
We've also got our requirement for RHOSTS.
So you set rhosts then our IP address.
Look at options again, make sure you didn't miss anything,
and then run.
If you're feeling 1337, you can type exploit--
does the same thing.
But again, we see that it's Samba 4.3.11 on Ubuntu--
same result, different command.
We're going to leave MSF.
There's a little bit more recon, new tool to utilize--
nmblookup.
And you can get comfortable with the Help page.
Go and read the documentation and the man page.
But what we are interested in is the capital A,
which is going to be --lookup-by-ip, and then
our IP.
And this is going to utilize that NetBIOS
protocol to connect.
And what it's showing is several different groups
and really what our connections do.
So we see a 20 here.
That means that we've got a server that we can actually
connect to.
In order to connect, we utilize smbclient.
Smbclient comes with most Linux distributions.
Let's look at the help.
There's a lot in here, but we want to list, with a capital
L--
list by host.
And we're also going to take advantage
of what we're going to check for, a null session.
See if one exists, and that's the -N.
So it was able to connect.
It got some information.
It didn't get a lot of information,
but we see some sharers, and we see IPC.
When you see IPC with a null session,
that's something we might be able to connect to.
The last tool we'll cover right now is rpcclient,
and we'll look at the Help page for that.
Why not?
We're going to connect with a null username, which
is like no user, no pass.
So it goes, rpcclient -U. We just
give it, empty string -N for --no-pass, their IP address,
and we're able to connect.
It didn't give us an error.
It didn't pop us out.
We actually were able to connect.
So we're connected with rpcclient.
What we can do here is not part of enumeration.
So with that, we'll end this.
So now, you've seen SMB can exist and be utilized
on Linux as well as Windows.