Now that you've seen some examples,
we're going to reinforce what we've already shown you
and teach you a little bit more.
Let's dive in.
Our IP address is this 192.76.242.2.
So our victim is going to be dot 3.
We see 139 and 445 up, we can do a quick service scan.
Putting the port number would help.
And it's that same Samba.
Let's connect with our PC client.
A null session, Continue dot three.
And in here, let's look at server info.
SRV info.
It tells us that our operating system is version 6.1.
We can add that to our notes.
Another tool we will look at is enum4linux.
Take a quick look at the help page.
What we want is to get the operating system information.
So we will use [INAUDIBLE] and our same 192.
Pretend like I remember the IP address, 76 242.
Three.
enum4linux is quite a powerful tool.
You can run a lot.
In this situation, we're just using it to get the operating
system information.
It found some usernames.
It found out that it allows for null sessions.
You got some sense and you got the operating system version,
which is 6.1.
Again we see that sum recon.
So it is gathering a lot of information for us.
We'll also check that out with smbclient.
We'll just list with a null session.
And in here we see again, samba.reconlab.
Now let's see what dialects it uses.
Let's grab our nmap scan.
I don't like typing things twice if I don't have to.
So our script is going to be SMB protocols, which
we've done before.
And this should tell us our SMB protocols and dialects.
And we get back that it's got SMB version 1, 202, 210, 3,
102, and 311.
Another way we can go about it is with good old MSF console.
We will use the auxiliary scanner for SMB,
trying to identify SMB two.
And later we'll get into Metasploit
and how to look up what scanners or modules or exploits
you want to take advantage of.
But for now, I just want to show you that it can be done.
Check our options.
Everything's filled in.
Now let's run it.
And it shows that it supports SMB 2, which
we would want to write down, come back to later.
If you don't know the importance, that is fine.
Enumeration is all about finding information.
Later, we'll use that information to find exploits.
Now what's kind of neat, is there
are scripts for enumerating users with SMB and nmap.
What it will do is, it connects with SMB.
And we've done this command before.
It looks like we've got an admin an Aisha, Ellie, Emma,
John, and Shawn.
It even gives their RID--
R IDs.
We would want to add this to our list.
And now you've got users on this machine.
That can be really helpful for credentials for playing later.
We'll look at enum4linux again.
In this case, [INAUDIBLE].
Again, that's going to look at users, showing
different ways to skin the cat.
[INAUDIBLE] capital U is going to get us our users.
And you got that same list, John, Ellie, Aisha, Shaun,
Emma, and admin.
Multiple ways of skinning this cat.
Show you one other way.
Do a null session with our PC client.
And then run enum dome users.
Gets us the same list, which it should.
Now let's look up some useful stuff.
So look up names and admin.
So we can get more.
So now we have a full SID of admin,
which could be really useful.
If you wanted to be anyone on this machine,
admin seems like the dead giveaway.
So that's a few more ways to gain information utilizing SMB.
And from there, let's jump into some challenges.