[MUSIC LOGO]
We're going to dive a little deeper into SMB and Samba.
There is so much that you can do with these services
and this protocol.
And even after all this, we've only scratched the surface.
But got to start you with something.
Look at our IP address.
Part of this 192.4.17.
It's our 24 network.
So to run an Nmap scan on the .3, and we see 139 and 445.
Can you hit the I Believe button with me
that they are indeed SMB Samba?
We're going to do smb-enum-shares this time.
We've looked at shares before.
Helps if you have a script in there.
There we are.
We see the shares.
We've got Aisha, Emma, IPC.
See its samba recon lab.
And you can even see who has access to what.
A little bit.
Let's build on that.
Because all this stuff, the sharers, the users,
who has access to read and write, we can utilize that.
We can use that.
That's why we are enumerating.
Like, when someone in a heist movie is casing a joint,
trying to figure out how to get in, we're doing the same thing.
We need to find out all of the possible ways in.
Then, there's another enum-shares auxiliary scanner
set rhosts to our IP address.
Always good to show options.
Everything with a Yes is filled in.
Most of it comes default, the way the tool is set up.
Unless someone tells you otherwise, trust it.
Unless you know otherwise, trust it.
And it brings back all those same shares.
Another way of cracking that nut.
Presents it to you in a different way.
We'll take a look at enum for Linux, doing the same thing.
Tag capital S. We'll do shares.
There's our list.
Now, I'm presenting this to you because it's not a tools class.
Pick the tool that you like.
Pick the tool that you think is useful.
Maybe you try several different tools.
And you'll figure out which ones you like the most.
And we're going to list out the shares with smbclient,
the tag L with a null session.
No password.
We've done that before.
Works fairly well.
Now, what we want to find out is what groups.
Groups are a lot like users or shares.
And in that, they can tell us useful stuff about our target.
Who has different rights, can do different things.
A user might not have access, but being part of a group,
then they do have access.
And we see, there's two groups-- there's maintainers,
and there's reserved.
We don't know exactly what that means,
but we can write it down, keep it for later.
Connect with our rpcclient with a null session.
Because we saw that it would connect before.
[INAUDIBLE] groups.
We see them again there, maintain there, and reserved.
Some of these scripts are just--
or some of these programs are just scripts,
doing the same thing and pulling out the details.
Like, this looks the exact same as what we just did,
without having to work through rpcclient.
We can see if the server is configured for printing.
Do enum for Linux.
With a tag i.
And we get back that no printers were returned.
So there are no printers.
We saw before that public was accessible.
Let's go back to smbclient.
This one actually lets us connect.
And we'll connect to that public with no password.
And we are in.
We can run help.
And a lot of our commands are standard Linux commands.
We see that there's directories.
It's going to secret.
Run another listening in cat flag.
How about we get the flag.
We'll leave that and now cat flag because it's a share.
So all we did is we downloaded with--
basically, we used get, which is the API way of asking for it.
We downloaded it, and then we took a look at it.
Pretty neat.
So we were able to figure all that out
by knowing that we had access with a null session.
Now, what if a null session doesn't particularly
work in that same way?
We'll look at that one in the next video, in the next lab.