[LOGO AUDIO]
So far, everything we've been looking at with SMB
has been a null session, or things
that we can connect to without having to authenticate.
When you do need to authenticate,
and you don't have the credentials yet,
you don't have the passwords, then
there's some things you can try out.
We have these things called word lists.
And they are known bad passwords.
They're passwords that people have used.
Some cases, like RockYou, which we'll use later,
was a word list that came from a bunch of passwords
that came from a social media website that got breached.
And all the passwords got shared.
And it had thousands upon thousands of passwords.
And the company was called RockYou.
We're going to utilize RockYou and those passwords
because people make the same mistakes with passwords.
It's why they're flawed.
It's why we use two-factor authentication
and unique difficult passwords.
But let's dig into how we actually
use that as part of attack to understand
how our adversary will use it as part of an attack.
Let's grab our IP address.
We're 192.125.26.2.
So we're going to Nmap scan the .3 on that.
And we see SMB is open.
What we want to try is, we're going
to enumerate this SMB share utilizing Metasploit and a word
list.
We use an auxiliary module, a scanner for SMB, SMB login.
And what this is going to do for our info,
it's going to test an SMB login on a range of machines
and report successful logins.
Let's take a look at our options.
And we're going to need to pass it a word list.
This user-pass file, that will be helpful.
And it needs a target.
So set Rhost.
We say Rhosts because that's what it calls it,
even if it's just one host.
What we'll do is set this pass file
to be user share word lists.
We'll use the Metasploit one for Unix passwords.
Now we're going to set the SMB user to be Jane.
In this situation, let's say that, we had previously
enumerated that Jane was a user.
And with that, we can just double check options, show
options.
It does the same thing.
It should do the same thing.
There we go.
Everything that is required is filled in.
This did a weird word wrap because of that password file.
Looks good.
Let's run it.
And what it tried is, it tried to connect and authenticate
with a bunch of passwords.
It tried 123456, 123456789.
And you're probably thinking, these are horrible passwords.
And they are, including password,
but someone has used them in the past.
They'll use them in the future.
People are people.
And there was even one that was successful, abc123.
So now we know Jane's password is abc123.
Let's try this another way.
We're going to use Hydra.
First we need to do some magic.
We're going to unzip a file.
It's user share word lists RockYou.txt.gz.
And that worked.
We're going to utilize Hydra.
Hydra is a very powerful tool.
Our login is going to be admin.
And we're going to pass it a password file.
If you do uppercase letters, like an uppercase L
or uppercase P, then you're telling it
you want to pass a file.
If you use a lowercase, then you're
going to give it a specific value.
Like lowercase l was the username, admin.
Uppercase P is going to be RockYou user share word lists
RockYou.
And we just unzip that, so it should work great.
We need a target and a protocol.
So we'll have it use those to authenticate with SMB.
It's fairly straightforward.
It works really nicely.
It found out that admin's password is password1.
We'll go about it one other way.
Let's do SNB map and our host.
It's going to be that.
We'll log in as admin with the password of password1.
We see that they have access to almost everything Nancy
is read only.
Let's find out if any of the shares are browse-able.
So SMBclient and let's list them out as user Jane
and as our password, abc123.
And no, it doesn't look like any of them
are browse-able by Jane.
Or rather, sorry, Jane's share is not browse-able
since we don't see Jane in there.
Now let's try it another way.
Let's do SMBclient.
In this case, let's connect and try connecting to Jane.
Even though it didn't have it in the listing,
let's see if it's there.
And we'll try to connect as Jane,
as the user, Jane, abc123.
Run LS.
And it seems like it was there, even though it didn't list it
when we used SMBclient.
Let's try that as admin.
We said there's an admin directory.
Let's check out the admin directory as admin, password1.
And we have a hidden directory.
Not so much a hidden directory, a directory called Hidden.
And in here we've got flag.tar.gz.
Let's GET that, which downloads it.
And then this might look confusing, flag.tar.gz.
With Linux you can do it, tar attack xf.
And it will gun-zip it and untar it.
So we end up with just flag itself.
Now another thing with SMB, SMB is
a protocol that can be used for many different services.
And the way services talk to one another, is through pipes.
Named pipes are pipes that are known.
So if we can get into SMB, there's
a chance that we can get into other services that
are piped through it, if we know the names of the pipes.
So let's enumerate that.
We'll do this with MSF Console.
We'll use an auxiliary scanner for SMB called Pipe Auditor.
And we'll set our SMB user as admin
and set SMB pass as password1.
We'll set Rhosts.
Check options.
Everything is filled out.
And Run.
And we get a list of these named pipes, Net log on,
LSARPC, SAMR, Event Log Init Shutdown.
You might not know what these mean
or how to use them right now, but we
would want to write all these down
in our notes to show that we found them, how we found them.
And then we might come back and use them later.
There might be exploits that require it.
Ironically, we have yet to actually exploit this machine,
despite the fact that we have gotten
some information from it.
That's really just more enumeration.
The last thing that we can do is, get a list of the SIDs
for different users.
We use ENUM for Linux and attack R
and attack U for admin, attack P, and lowercase password1.
Enter our IP address.
And with this lowercase r, it should be looking for users.
It is working a lot.
There it is.
So our users, Sean, Jane, Nancy and admin,
now we have their SIDs.
That might become helpful later if we
need to spoof things or just identify.
That's going to be it for SMB.
That's a lot that we were able to enumerate,
a lot that we were able to get from it.
Hopefully it was some more tools for your toolbox
and an understanding of how we go about doing this enumeration
thing.
Let's get into some more on protocols.