Skip to content

Enumeration.md

Latest commit

 

History

History
100 lines (71 loc) · 2.43 KB

Enumeration.md

File metadata and controls

100 lines (71 loc) · 2.43 KB

NMAP

Alive hosts

nmap -sn 10.0.0.0/24

scan the 1024 most common ports, run OS detection, run default nmap scripts

nmap -A -oA nmap

Scan more deeply, scan all 65535 ports on $targetip with a full connect scan

nmap -v -sT -p-

more options

nmap -sV -sC -v -A -p- nmap -sT -sV -A -O -v -p 1–65535

my preference

nmap -sV -sC -v -oA output nmap -p- -v

SMB

Port 139 and 445- SMB/Samba shares Samba is a service that enables the user to share files with other machines works the same as a command line FTP client, may browse files without even having credentials

Share List:

smbclient --list smbclient -L

Check SMB vulnerabilities:

nmap --script=smb-check-vulns.nse -p445

basic nmap scripts to enumerate shares and OS discovery

nmap -p 139,445 192.168.1.1/24 --script smb-enum-shares.nse smb-os-discovery.nse

Connect using Username

root@kali:~# smbclient -L -U username -p 445

Connect to Shares

smbclient \\\ShareName smbclient \\\ShareName -U john

enumarete with smb-shares, -a “do everything” option

enum4linux -a 192.168.1.120

learn the machine name and then enumerate with smbclient

nmblookup -A 192.168.1.102 smbclient -L <server_name> -I 192.168.1.105

rpcclient - Connect with a null-session (only works for older windows servers)

rpcclient -U james 10.10.10.52 rpcclient -U "" 192.168.1.105 (press enter if asks for a password) rpcclient $&gt; srvinfo rpcclient $&gt; enumdomusers rpcclient $&gt; enumalsgroups domain rpcclient $&gt; lookupnames administrators rpcclient> querydominfo rpcclient> enumdomusers rpcclient> queryuser john

scan for vulnerabilities with nmap

nmap --script "vuln" -p139,445

SMTP

telnet or netcat connection

nc 25 VRFY root

Check for commands

nmap -script smtp-commands.nse

Port 111 - RPC

Rpcbind can help us look for NFS-shares. So look out for nfs. Obtain list of services running with RPC:

rpcbind -p rpcinfo –p x.x.x.x

using nmap, see which port NFS is listening

locate rpc.nse nmap --script rpcinfo.nse -p 111

NFS

to find the public share

locate nfs.nse nmap --script nfs-showmount.nse

mount the share to a folder under /tmp

mkdir /tmp/nfs /sbin/mount.nfs :/home/box /tmp/nfs