Skip to content

Commit 47d2917

Browse files
author
Brent Cook
committed
Land rapid7#8418, Add docs for 3 smb related aux modules
2 parents 0733790 + ae0fd66 commit 47d2917

File tree

3 files changed

+408
-0
lines changed

3 files changed

+408
-0
lines changed

‎documentation/modules/auxiliary/scanner/smb/smb_enumusers.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
The `smb_enumusers` module enumerates users via SAM User Enumeration over the SMB user interface.
2+
This module works against Windows and Samba.
3+
4+
## Vulnerable Application
5+
6+
To use `smb_enumusers`, make sure you are able to connect to a SMB service that supports SMBv1.
7+
8+
## Verification Steps
9+
10+
1. Do: ```use auxiliary/scanner/smb/smb_enumusers```
11+
2. Do: ```set rhosts [IP]```
12+
3. Do: ```run```
13+
14+
## Scenarios
15+
16+
### Metasploitable2 (Samba)
17+
18+
```
19+
msf auxiliary(smb_enumusers) > run
20+
21+
[+] 10.9.7.35:139 - METASPLOITABLE [ games, nobody, bind, proxy, syslog, user, www-data, root, news, postgres, bin, mail, distccd, proftpd, dhcp, daemon, sshd, man, lp, mysql, gnats, libuuid, backup, msfadmin, telnetd, sys, klog, postfix, service, list, irc, ftp, tomcat55, sync, uucp ] ( LockoutTries=0 PasswordMin=5 )
22+
```
23+
24+
### Windows 2000 SP4
25+
26+
```
27+
[+] 10.9.7.127:445 - WIN2K [ disabled, Guest, renamedAdministrator, test ] ( LockoutTries=0 PasswordMin=0 )
28+
```
29+
30+
## Confirmation with nmap
31+
32+
NMAP utilizes [smb-enum-users](https://nmap.org/nsedoc/scripts/smb-enum-users.html) to do SID bruteforcing.
33+
34+
```
35+
nmap --script smb-enum-users.nse -p445 10.9.7.127,35
36+
37+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-19 14:36 EDT
38+
Nmap scan report for 10.9.7.35
39+
Host is up (0.0013s latency).
40+
PORT STATE SERVICE
41+
445/tcp open microsoft-ds
42+
MAC Address: 00:0C:29:59:D4:F7 (VMware)
43+
44+
Host script results:
45+
| smb-enum-users:
46+
| METASPLOITABLE\backup (RID: 1068)
47+
| Full name: backup
48+
| Flags: Account disabled, Normal user account
49+
| METASPLOITABLE\bin (RID: 1004)
50+
| Full name: bin
51+
| Flags: Account disabled, Normal user account
52+
| METASPLOITABLE\bind (RID: 1210)
53+
| Flags: Account disabled, Normal user account
54+
| METASPLOITABLE\daemon (RID: 1002)
55+
| Full name: daemon
56+
| Flags: Account disabled, Normal user account
57+
| METASPLOITABLE\dhcp (RID: 1202)
58+
| Flags: Account disabled, Normal user account
59+
| METASPLOITABLE\distccd (RID: 1222)
60+
| Flags: Account disabled, Normal user account
61+
| METASPLOITABLE\ftp (RID: 1214)
62+
| Flags: Account disabled, Normal user account
63+
```
64+
...snip...
65+
66+
```
67+
| METASPLOITABLE\tomcat55 (RID: 1220)
68+
| Flags: Account disabled, Normal user account
69+
| METASPLOITABLE\user (RID: 3002)
70+
| Full name: just a user,111,,
71+
| Flags: Normal user account
72+
| METASPLOITABLE\uucp (RID: 1020)
73+
| Full name: uucp
74+
| Flags: Account disabled, Normal user account
75+
| METASPLOITABLE\www-data (RID: 1066)
76+
| Full name: www-data
77+
|_ Flags: Account disabled, Normal user account
78+
79+
Nmap scan report for win2k (10.9.7.127)
80+
Host is up (0.0013s latency).
81+
PORT STATE SERVICE
82+
445/tcp open microsoft-ds
83+
MAC Address: 00:0C:29:C8:97:2D (VMware)
84+
85+
Host script results:
86+
| smb-enum-users:
87+
| WIN2K\disabled (RID: 1000)
88+
| Full name: disabled
89+
| Description: user account is disabled
90+
| Flags: Account disabled, Normal user account
91+
| WIN2K\Guest (RID: 501)
92+
| Description: Built-in account for guest access to the computer/domain
93+
| Flags: Password not required, Password does not expire, Account disabled, Normal user account
94+
| WIN2K\renamedAdministrator (RID: 500)
95+
| Description: Built-in account for administering the computer/domain
96+
| Flags: Password does not expire, Normal user account
97+
| WIN2K\test (RID: 1001)
98+
| Full name: test
99+
|_ Flags: Normal user account
100+
101+
Nmap done: 2 IP addresses (2 hosts up) scanned in 0.62 seconds
102+
```

‎documentation/modules/auxiliary/scanner/smb/smb_lookupsid.md

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
The `smb_lookupsid` module bruteforces the SID of the user, to obtain the username or group name.
2+
This module works against Windows and Samba.
3+
This module can also be used to lookup the information against a Domain utilizing the `action` option.
4+
SID 500 is always the default administrator account, while user accounts start in the 1000 range.
5+
6+
## Vulnerable Application
7+
8+
To use `smb_lookupsid`, make sure you are able to connect to a SMB service that supports SMBv1.
9+
10+
## Verification Steps
11+
12+
1. Do: ```use auxiliary/scanner/smb/smb_lookupsid```
13+
2. Do: ```set rhosts [IP]```
14+
3. Do: ```run```
15+
16+
## Scenarios
17+
18+
### Windows 2000 SP4
19+
20+
```
21+
msf > use auxiliary/scanner/smb/smb_lookupsid
22+
msf auxiliary(smb_lookupsid) > set rhosts 10.9.7.127
23+
rhosts => 10.9.7.127
24+
25+
[*] 10.9.7.127:445 - PIPE(LSARPC) LOCAL(WIN2K - 5-21-484763869-823518204-682003330) DOMAIN(RAGEGROUP - )
26+
[*] 10.9.7.127:445 - USER=renamedAdministrator RID=500
27+
[*] 10.9.7.127:445 - USER=Guest RID=501
28+
[*] 10.9.7.127:445 - GROUP=None RID=513
29+
[*] 10.9.7.127:445 - USER=disabled RID=1000
30+
[*] 10.9.7.127:445 - USER=test RID=1001
31+
[*] 10.9.7.127:445 - WIN2K [renamedAdministrator, Guest, disabled, test ]
32+
[*] Scanned 1 of 1 hosts (100% complete)
33+
[*] Auxiliary module execution completed
34+
```
35+
36+
### Metasploitable2 (Samba)
37+
38+
```
39+
msf auxiliary(smb_lookupsid) > run
40+
41+
[*] Scanned 26 of 253 hosts (10% complete)
42+
[*] 10.9.7.35:139 - PIPE(LSARPC) LOCAL(METASPLOITABLE - 5-21-1042354039-2475377354-766472396) DOMAIN(WORKGROUP - )
43+
[*] 10.9.7.35:139 - USER=Administrator RID=500
44+
[*] 10.9.7.35:139 - USER=nobody RID=501
45+
[*] 10.9.7.35:139 - GROUP=Domain Admins RID=512
46+
[*] 10.9.7.35:139 - GROUP=Domain Users RID=513
47+
[*] 10.9.7.35:139 - GROUP=Domain Guests RID=514
48+
[*] 10.9.7.35:139 - USER=root RID=1000
49+
[*] 10.9.7.35:139 - GROUP=root RID=1001
50+
[*] 10.9.7.35:139 - USER=daemon RID=1002
51+
[*] 10.9.7.35:139 - GROUP=daemon RID=1003
52+
[*] 10.9.7.35:139 - USER=bin RID=1004
53+
[*] 10.9.7.35:139 - GROUP=bin RID=1005
54+
[*] 10.9.7.35:139 - USER=sys RID=1006
55+
[*] 10.9.7.35:139 - GROUP=sys RID=1007
56+
```
57+
...snip...
58+
59+
```
60+
[*] 10.9.7.35:139 - USER=user RID=3002
61+
[*] 10.9.7.35:139 - GROUP=user RID=3003
62+
[*] 10.9.7.35:139 - USER=service RID=3004
63+
[*] 10.9.7.35:139 - GROUP=service RID=3005
64+
[*] 10.9.7.35:139 - METASPLOITABLE [Administrator, nobody, root, daemon, bin, sys, sync, games, man, lp, mail, news, uucp, proxy, www-data, backup, list, irc, gnats, libuuid, dhcp, syslog, klog, sshd, bind, postfix, ftp, postgres, mysql, tomcat55, distccd, telnetd, proftpd, statd, msfadmin, user, service ]
65+
```
66+
67+
## Confirmation with nmap
68+
69+
NMAP utilizes [smb-enum-users](https://nmap.org/nsedoc/scripts/smb-enum-users.html) to do SID bruteforcing.
70+
71+
```
72+
nmap --script smb-enum-users.nse -p445 10.9.7.127,35
73+
74+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-19 14:36 EDT
75+
Nmap scan report for 10.9.7.35
76+
Host is up (0.0013s latency).
77+
PORT STATE SERVICE
78+
445/tcp open microsoft-ds
79+
MAC Address: 00:0C:29:59:D4:F7 (VMware)
80+
81+
Host script results:
82+
| smb-enum-users:
83+
| METASPLOITABLE\backup (RID: 1068)
84+
| Full name: backup
85+
| Flags: Account disabled, Normal user account
86+
| METASPLOITABLE\bin (RID: 1004)
87+
| Full name: bin
88+
| Flags: Account disabled, Normal user account
89+
| METASPLOITABLE\bind (RID: 1210)
90+
| Flags: Account disabled, Normal user account
91+
| METASPLOITABLE\daemon (RID: 1002)
92+
| Full name: daemon
93+
| Flags: Account disabled, Normal user account
94+
| METASPLOITABLE\dhcp (RID: 1202)
95+
| Flags: Account disabled, Normal user account
96+
| METASPLOITABLE\distccd (RID: 1222)
97+
| Flags: Account disabled, Normal user account
98+
| METASPLOITABLE\ftp (RID: 1214)
99+
| Flags: Account disabled, Normal user account
100+
```
101+
...snip...
102+
103+
```
104+
| METASPLOITABLE\tomcat55 (RID: 1220)
105+
| Flags: Account disabled, Normal user account
106+
| METASPLOITABLE\user (RID: 3002)
107+
| Full name: just a user,111,,
108+
| Flags: Normal user account
109+
| METASPLOITABLE\uucp (RID: 1020)
110+
| Full name: uucp
111+
| Flags: Account disabled, Normal user account
112+
| METASPLOITABLE\www-data (RID: 1066)
113+
| Full name: www-data
114+
|_ Flags: Account disabled, Normal user account
115+
116+
Nmap scan report for win2k (10.9.7.127)
117+
Host is up (0.0013s latency).
118+
PORT STATE SERVICE
119+
445/tcp open microsoft-ds
120+
MAC Address: 00:0C:29:C8:97:2D (VMware)
121+
122+
Host script results:
123+
| smb-enum-users:
124+
| WIN2K\disabled (RID: 1000)
125+
| Full name: disabled
126+
| Description: user account is disabled
127+
| Flags: Account disabled, Normal user account
128+
| WIN2K\Guest (RID: 501)
129+
| Description: Built-in account for guest access to the computer/domain
130+
| Flags: Password not required, Password does not expire, Account disabled, Normal user account
131+
| WIN2K\renamedAdministrator (RID: 500)
132+
| Description: Built-in account for administering the computer/domain
133+
| Flags: Password does not expire, Normal user account
134+
| WIN2K\test (RID: 1001)
135+
| Full name: test
136+
|_ Flags: Normal user account
137+
138+
Nmap done: 2 IP addresses (2 hosts up) scanned in 0.62 seconds
139+
```

0 commit comments

Comments
 (0)