ENUMERATING SERVICES

Enumeration Services is a vital next step, this will help us identify users, host information, protocol weaknesses and vulnerabilities we can use to our advantage.

nmap -vv -Pn -A -sC -sS -T 4 -p- 10.0.0.1
Web Enumeration:

dirb http://10.0.0.1 /usr/share/wordlists/dirb/common.txt

nikto –host http://10.0.0.1
SMB\RPC Enumeration:

Netbios/SMB

smb4k (graphical interface – lists shares)

smbserverscan
metasploit auxiliary scanner

./msfconsole show
use scanner/smb/version

set RHOSTS 192.168.0.1-192.168.0.254

run
Enumerate Usernames (SNMP/SMTP/SMB[NETBIOS]/Add others here)
For SMB

nmap -sT -p 445 192.168.9.200-254 -oG smb_results.txt (then grep open sessions) (on my machine /root/offsec) ./samrdump.py 192.168.9.201 (results from above)

enum4linux 10.0.0.1

nmap –script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse 10.0.0.1
Mysql Enumeration:

nmap -sV -Pn -vv –script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.0.1 -p 3306
SMTP Enumeration:

nmap –script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.0.0.1
SNMP Enumeration:

snmpwalk -c public -v1 192.168.9.254 1 |grep hrSWRunName|cut -d” ” -f

snmpwalk -c public -v1 10.0.0.0

snmpenum -t 192.168.0.100 (displays all snmp informations for that server)

nmap -sT -p 161 192.168.9.200/254 -oG snmp_results.txt (then grep)

– snmpwalk public -v1 192.168.9.201 1 |grep 77.1.2.25 |cut -d” “ -f4

For SMTP – (/pentest/enumeration/vrfy)

./smtp_VRFY.py

** NEED TO MAKE THREADED – VERY SLOW **
SAMRDUMP.PY – (/pentest/python/impacket-examples/samrdump.py)

– ./samrdump.py SNMP server

nc -v 25
FTP Enumeration:

nmap –script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 10.0.0.1

DNS ENUMERATION

he types of enumeration that performs include the following:

• Zone Transfer
• Reverse Lookup
• Domain and Host Brute-Force
• Standard Record Enumeration (wildcard,SOA,MX,A,TXT etc.)
• Cache Snooping
• Zone Walking
• Google Lookup

Standard Record Enumeration

In order to perform standard DNS enumeration with the DNSRecon the command that we have to use is the ./dnsrecon.py -d .So let’s try that command against the domain cisco.com to see what kind of information can we retrieve.

Zone Transfer

The security problem with DNS zone transfer is that it can be used to decipher the topology of a company’s network.Specifically when a user is trying to perform a zone transfer it sends a DNS query to list all DNS information like name servers,host names,MX and CNAME records,zone serial number,Time to Live records etc.Due to the amount of information that can be obtained DNS zone transfer cannot be easily found in nowadays.However DNSRecon provides the ability to perform Zone Transfers with the commands

./dnsrecon.py -d -a or

./dnsrecon.py -d -t axfr

Reverse Lookup

According to Wikipedia reverse DNS lookup is the determination of a domain name with the associated IP address.DNSRecon can perform a Reverse Lookup for PTR (Pointer) records against IPv4 and IPv6 address ranges.To run reverse lookup enumeration the command

./dnsrecon.py -r

must be used.Also reverse lookup can be performed against all ranges in SPF records with the command ./dnsrecon.py -d -s.In the next image you can see the output that produces a reverse lookup in a range of IP addresses.

Domain Brute-Force

For performing this technique all we have to do is to give a name list and it will try to resolve the A,AAA and CNAME records against the domain by trying each entry one by one.In order to run the Domain Name Brute-Force we need to type:

./dnsrecon.py -d -D -t brt

Cache Snooping

DNS cache snooping is occurred when the DNS server has a specific DNS record cached.This DNS record will often reveal plenty of information.However DNS cache snooping is not happening very often.The command that can be used in order to perform cache snooping is the following:

./dnsrecon.py -t snoop -n Sever -D

Zone Walking

This technique may unveils internal records if zone is not configured properly.The information that can be obtained can help us to map network hosts by enumerating the contents of a zone.In order to perform the zone walking we need to type the command:

./dnsrecon.py -d -t zonewalk

SMB\RPC Enumeration:
enum4linux 10.0.0.1

nmap –script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse 10.0.0.1
You can also use:
nmap –script=smb* -p 139,445 10.0.0.1
permalinkembedsavereportgive goldreply
[–]ok_bye_now_[S] 1 point 2 months ago
If you run all of them it’ll take forever because of the brute force NSE scripts. That’s why I chose to list all of them minus the bruters.
permalinkembedsaveparentreportgive goldreply
[–]ak_z 6 points 2 months ago*
nicie, but I’ve seen better
permalinkembedsavereportgive goldreply
[–]m_ros101 2 points 2 months ago
Great work mate. Thanks for this.
permalinkembedsavereportgive goldreply
[–]ok_bye_now_[S] 1 point 2 months ago
Enumerating snmp strings is also something I should add to that list. It’s fairly easy to overlook but you sometimes find really useful information in there.
permalinkembedsavereportgive goldreply
[–]qasimchadhar 1 point 2 months ago
Thanks. One thing to note, these cheat sheets will come handy in your professional career too. And as you learn something new, be sure to add to your favorite cheat sheet.
permalinkembedsavereportgive goldreply
nmap -PN 192.168.9.200-254

rpcclient $>

Now type in enumdomusers, this will dump a list of user accounts that are present on the share like so:

rpcclient $> enumdomusers
user:[nobody] rid:[0x1f5]
user:[gh0s7] rid:[0x3e8]

Yes enumerating user accounts through open samba or smb is that simple. There are many more options that can be used with this program, if you type help at the rpcclient prompt you will see all of the options. There are a few different commands that I used to create the log file for this tutorial.
1)enumdomusers
2)netshareenum
3)netshareenumall
4)querydominfo

****Append Log File****
/*NULL SESSION CONNECTION*/
root@bt:~# rpcclient -U “” 192.168.1.12
Enter ‘s password:

/*ENUMERATING USERS*/
rpcclient $> enumdomusers
user:[nobody] rid:[0x1f5]
user:[gh0s7] rid:[0x3e8]
/*FINDING NETWORK SHARE INFO ON THE LOCAL MACHINE*/
rpcclient $> netshareenum
netname: test
remark:
path: C:\media\Gh0$7\test
password:
/*OR*/
rpcclient $> netshareenumall
netname: IPC$
remark: IPC Service (gh0s7-serverhome server (Samba, Ubuntu))
path: C:\tmp
password:
netname: test
remark:
path: C:\media\Gh0$7\test
password:
netname: print$
remark: Printer Drivers
path: C:\var\lib\samba\printers
password:

/*QUERYING SERVER INFO (NAME AND DOMAIN)*/
rpcclient $> querydominfo
Domain: MSHOME
Server: GH0S7-SERVERHOME
Comment: gh0s7-serverhome server (Samba, Ubuntu)
Total Users: 2
Total Groups: 0
Total Aliases: 0
Sequence No: 1321411072
Force Logoff: -1
Domain Server State: 0x1
Server Role: ROLE_DOMAIN_PDC
Unknown 3: 0x1

Mounting unprotected (guest) network folders

First, let’s create the mount directory. You will need a separate directory for each mount.

sudo mkdir /media/windowsshare

Then edit your /etc/fstab file (with root privileges) to add this line:

//servername/sharename  /media/windowsshare  cifs  guest,uid=1000,iocharset=utf8  0  0

Where

guest indicates you don’t need a password to access the share,

uid=1000 makes the Linux user specified by the id the owner of the mounted share, allowing them to rename files,

iocharset=utf8 allows access to files with names in non-English languages. This doesn’t work with shares of devices like the Buffalo Tera Station, or Windows machines that export their shares using ISO8895-15.

If there is any space in the server path, you need to replace it by \040, for example //servername/My\040Documents

After you add the entry to /etc/fstab type:

sudo mount -a

This will (re)mount all entries listed in /etc/fstab.

Mount password protected network folders

The quickest way to auto-mounting a password-protected share is to edit /etc/fstab (with root privileges), to add this line:
//servername/sharename  /media/windowsshare  cifs  username=msusername,password=mspassword,iocharset=utf8,sec=ntlm  0  0

To see which shares are available on a given host, run:

/usr/bin/smbclient -L host

where ‘host’ is the name of the machine that you wish to view. this will return a list of ‘service’ names – that is, names of drives or printers that it can share with you. Unless the SMB server has no security configured, it will ask you for a password. Get it the password for the ‘guest’ account or for your personal account on that machine.

For example:

smbclient -L zimmerman

The output of this command should look something like this:

Server time is Sat Aug 10 15:58:27 1996
Timezone is UTC+10.0
Password:
Domain=[WORKGROUP] OS=[Windows NT 3.51] Server=[NT LAN Manager 3.51]

Server=[ZIMMERMAN] User=[] Workgroup=[WORKGROUP] Domain=[]

Sharename      Type      Comment
———      —-      ——-
ADMIN$         Disk      Remote Admin
public         Disk      Public
C$             Disk      Default share
IPC$           IPC       Remote IPC
OReilly        Printer   OReilly
print$         Disk      Printer Drivers