Skip to content

Commit ae0fd66

Browse files
h00dieh00die
committed
smb docs looking good
1 parent 34f724c commit ae0fd66

File tree

3 files changed

+294
-32
lines changed

3 files changed

+294
-32
lines changed

‎documentation/modules/auxiliary/scanner/smb/smb_enumusers.md

Lines changed: 77 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
The `smb_enumusers` module ?????????????????????????????????
1+
The `smb_enumusers` module enumerates users via SAM User Enumeration over the SMB user interface.
22
This module works against Windows and Samba.
33

44
## Vulnerable Application
@@ -18,11 +18,85 @@ To use `smb_enumusers`, make sure you are able to connect to a SMB service that
1818
```
1919
msf auxiliary(smb_enumusers) > run
2020
21-
[+] 192.168.2.35:139 - METASPLOITABLE [ games, nobody, bind, proxy, syslog, user, www-data, root, news, postgres, bin, mail, distccd, proftpd, dhcp, daemon, sshd, man, lp, mysql, gnats, libuuid, backup, msfadmin, telnetd, sys, klog, postfix, service, list, irc, ftp, tomcat55, sync, uucp ] ( LockoutTries=0 PasswordMin=5 )
21+
[+] 10.9.7.35:139 - METASPLOITABLE [ games, nobody, bind, proxy, syslog, user, www-data, root, news, postgres, bin, mail, distccd, proftpd, dhcp, daemon, sshd, man, lp, mysql, gnats, libuuid, backup, msfadmin, telnetd, sys, klog, postfix, service, list, irc, ftp, tomcat55, sync, uucp ] ( LockoutTries=0 PasswordMin=5 )
2222
```
2323

2424
### Windows 2000 SP4
2525

2626
```
27-
[+] 192.168.2.127:445 - WIN2K [ disabled, Guest, renamedAdministrator, test ] ( LockoutTries=0 PasswordMin=0 )
27+
[+] 10.9.7.127:445 - WIN2K [ disabled, Guest, renamedAdministrator, test ] ( LockoutTries=0 PasswordMin=0 )
28+
```
29+
30+
## Confirmation with nmap
31+
32+
NMAP utilizes [smb-enum-users](https://nmap.org/nsedoc/scripts/smb-enum-users.html) to do SID bruteforcing.
33+
34+
```
35+
nmap --script smb-enum-users.nse -p445 10.9.7.127,35
36+
37+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-19 14:36 EDT
38+
Nmap scan report for 10.9.7.35
39+
Host is up (0.0013s latency).
40+
PORT STATE SERVICE
41+
445/tcp open microsoft-ds
42+
MAC Address: 00:0C:29:59:D4:F7 (VMware)
43+
44+
Host script results:
45+
| smb-enum-users:
46+
| METASPLOITABLE\backup (RID: 1068)
47+
| Full name: backup
48+
| Flags: Account disabled, Normal user account
49+
| METASPLOITABLE\bin (RID: 1004)
50+
| Full name: bin
51+
| Flags: Account disabled, Normal user account
52+
| METASPLOITABLE\bind (RID: 1210)
53+
| Flags: Account disabled, Normal user account
54+
| METASPLOITABLE\daemon (RID: 1002)
55+
| Full name: daemon
56+
| Flags: Account disabled, Normal user account
57+
| METASPLOITABLE\dhcp (RID: 1202)
58+
| Flags: Account disabled, Normal user account
59+
| METASPLOITABLE\distccd (RID: 1222)
60+
| Flags: Account disabled, Normal user account
61+
| METASPLOITABLE\ftp (RID: 1214)
62+
| Flags: Account disabled, Normal user account
63+
```
64+
...snip...
65+
66+
```
67+
| METASPLOITABLE\tomcat55 (RID: 1220)
68+
| Flags: Account disabled, Normal user account
69+
| METASPLOITABLE\user (RID: 3002)
70+
| Full name: just a user,111,,
71+
| Flags: Normal user account
72+
| METASPLOITABLE\uucp (RID: 1020)
73+
| Full name: uucp
74+
| Flags: Account disabled, Normal user account
75+
| METASPLOITABLE\www-data (RID: 1066)
76+
| Full name: www-data
77+
|_ Flags: Account disabled, Normal user account
78+
79+
Nmap scan report for win2k (10.9.7.127)
80+
Host is up (0.0013s latency).
81+
PORT STATE SERVICE
82+
445/tcp open microsoft-ds
83+
MAC Address: 00:0C:29:C8:97:2D (VMware)
84+
85+
Host script results:
86+
| smb-enum-users:
87+
| WIN2K\disabled (RID: 1000)
88+
| Full name: disabled
89+
| Description: user account is disabled
90+
| Flags: Account disabled, Normal user account
91+
| WIN2K\Guest (RID: 501)
92+
| Description: Built-in account for guest access to the computer/domain
93+
| Flags: Password not required, Password does not expire, Account disabled, Normal user account
94+
| WIN2K\renamedAdministrator (RID: 500)
95+
| Description: Built-in account for administering the computer/domain
96+
| Flags: Password does not expire, Normal user account
97+
| WIN2K\test (RID: 1001)
98+
| Full name: test
99+
|_ Flags: Normal user account
100+
101+
Nmap done: 2 IP addresses (2 hosts up) scanned in 0.62 seconds
28102
```

‎documentation/modules/auxiliary/scanner/smb/smb_lookupsid.md

Lines changed: 103 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,16 @@ To use `smb_lookupsid`, make sure you are able to connect to a SMB service that
1919

2020
```
2121
msf > use auxiliary/scanner/smb/smb_lookupsid
22-
msf auxiliary(smb_lookupsid) > set rhosts 192.168.2.127
23-
rhosts => 192.168.2.127
24-
25-
[*] 192.168.2.127:445 - PIPE(LSARPC) LOCAL(WIN2K - 5-21-484763869-823518204-682003330) DOMAIN(RAGEGROUP - )
26-
[*] 192.168.2.127:445 - USER=renamedAdministrator RID=500
27-
[*] 192.168.2.127:445 - USER=Guest RID=501
28-
[*] 192.168.2.127:445 - GROUP=None RID=513
29-
[*] 192.168.2.127:445 - USER=disabled RID=1000
30-
[*] 192.168.2.127:445 - USER=test RID=1001
31-
[*] 192.168.2.127:445 - WIN2K [renamedAdministrator, Guest, disabled, test ]
22+
msf auxiliary(smb_lookupsid) > set rhosts 10.9.7.127
23+
rhosts => 10.9.7.127
24+
25+
[*] 10.9.7.127:445 - PIPE(LSARPC) LOCAL(WIN2K - 5-21-484763869-823518204-682003330) DOMAIN(RAGEGROUP - )
26+
[*] 10.9.7.127:445 - USER=renamedAdministrator RID=500
27+
[*] 10.9.7.127:445 - USER=Guest RID=501
28+
[*] 10.9.7.127:445 - GROUP=None RID=513
29+
[*] 10.9.7.127:445 - USER=disabled RID=1000
30+
[*] 10.9.7.127:445 - USER=test RID=1001
31+
[*] 10.9.7.127:445 - WIN2K [renamedAdministrator, Guest, disabled, test ]
3232
[*] Scanned 1 of 1 hosts (100% complete)
3333
[*] Auxiliary module execution completed
3434
```
@@ -39,27 +39,101 @@ rhosts => 192.168.2.127
3939
msf auxiliary(smb_lookupsid) > run
4040
4141
[*] Scanned 26 of 253 hosts (10% complete)
42-
[*] 192.168.2.35:139 - PIPE(LSARPC) LOCAL(METASPLOITABLE - 5-21-1042354039-2475377354-766472396) DOMAIN(WORKGROUP - )
43-
[*] 192.168.2.35:139 - USER=Administrator RID=500
44-
[*] 192.168.2.35:139 - USER=nobody RID=501
45-
[*] 192.168.2.35:139 - GROUP=Domain Admins RID=512
46-
[*] 192.168.2.35:139 - GROUP=Domain Users RID=513
47-
[*] 192.168.2.35:139 - GROUP=Domain Guests RID=514
48-
[*] 192.168.2.35:139 - USER=root RID=1000
49-
[*] 192.168.2.35:139 - GROUP=root RID=1001
50-
[*] 192.168.2.35:139 - USER=daemon RID=1002
51-
[*] 192.168.2.35:139 - GROUP=daemon RID=1003
52-
[*] 192.168.2.35:139 - USER=bin RID=1004
53-
[*] 192.168.2.35:139 - GROUP=bin RID=1005
54-
[*] 192.168.2.35:139 - USER=sys RID=1006
55-
[*] 192.168.2.35:139 - GROUP=sys RID=1007
42+
[*] 10.9.7.35:139 - PIPE(LSARPC) LOCAL(METASPLOITABLE - 5-21-1042354039-2475377354-766472396) DOMAIN(WORKGROUP - )
43+
[*] 10.9.7.35:139 - USER=Administrator RID=500
44+
[*] 10.9.7.35:139 - USER=nobody RID=501
45+
[*] 10.9.7.35:139 - GROUP=Domain Admins RID=512
46+
[*] 10.9.7.35:139 - GROUP=Domain Users RID=513
47+
[*] 10.9.7.35:139 - GROUP=Domain Guests RID=514
48+
[*] 10.9.7.35:139 - USER=root RID=1000
49+
[*] 10.9.7.35:139 - GROUP=root RID=1001
50+
[*] 10.9.7.35:139 - USER=daemon RID=1002
51+
[*] 10.9.7.35:139 - GROUP=daemon RID=1003
52+
[*] 10.9.7.35:139 - USER=bin RID=1004
53+
[*] 10.9.7.35:139 - GROUP=bin RID=1005
54+
[*] 10.9.7.35:139 - USER=sys RID=1006
55+
[*] 10.9.7.35:139 - GROUP=sys RID=1007
5656
```
5757
...snip...
5858

5959
```
60-
[*] 192.168.2.35:139 - USER=user RID=3002
61-
[*] 192.168.2.35:139 - GROUP=user RID=3003
62-
[*] 192.168.2.35:139 - USER=service RID=3004
63-
[*] 192.168.2.35:139 - GROUP=service RID=3005
64-
[*] 192.168.2.35:139 - METASPLOITABLE [Administrator, nobody, root, daemon, bin, sys, sync, games, man, lp, mail, news, uucp, proxy, www-data, backup, list, irc, gnats, libuuid, dhcp, syslog, klog, sshd, bind, postfix, ftp, postgres, mysql, tomcat55, distccd, telnetd, proftpd, statd, msfadmin, user, service ]
60+
[*] 10.9.7.35:139 - USER=user RID=3002
61+
[*] 10.9.7.35:139 - GROUP=user RID=3003
62+
[*] 10.9.7.35:139 - USER=service RID=3004
63+
[*] 10.9.7.35:139 - GROUP=service RID=3005
64+
[*] 10.9.7.35:139 - METASPLOITABLE [Administrator, nobody, root, daemon, bin, sys, sync, games, man, lp, mail, news, uucp, proxy, www-data, backup, list, irc, gnats, libuuid, dhcp, syslog, klog, sshd, bind, postfix, ftp, postgres, mysql, tomcat55, distccd, telnetd, proftpd, statd, msfadmin, user, service ]
65+
```
66+
67+
## Confirmation with nmap
68+
69+
NMAP utilizes [smb-enum-users](https://nmap.org/nsedoc/scripts/smb-enum-users.html) to do SID bruteforcing.
70+
71+
```
72+
nmap --script smb-enum-users.nse -p445 10.9.7.127,35
73+
74+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-19 14:36 EDT
75+
Nmap scan report for 10.9.7.35
76+
Host is up (0.0013s latency).
77+
PORT STATE SERVICE
78+
445/tcp open microsoft-ds
79+
MAC Address: 00:0C:29:59:D4:F7 (VMware)
80+
81+
Host script results:
82+
| smb-enum-users:
83+
| METASPLOITABLE\backup (RID: 1068)
84+
| Full name: backup
85+
| Flags: Account disabled, Normal user account
86+
| METASPLOITABLE\bin (RID: 1004)
87+
| Full name: bin
88+
| Flags: Account disabled, Normal user account
89+
| METASPLOITABLE\bind (RID: 1210)
90+
| Flags: Account disabled, Normal user account
91+
| METASPLOITABLE\daemon (RID: 1002)
92+
| Full name: daemon
93+
| Flags: Account disabled, Normal user account
94+
| METASPLOITABLE\dhcp (RID: 1202)
95+
| Flags: Account disabled, Normal user account
96+
| METASPLOITABLE\distccd (RID: 1222)
97+
| Flags: Account disabled, Normal user account
98+
| METASPLOITABLE\ftp (RID: 1214)
99+
| Flags: Account disabled, Normal user account
100+
```
101+
...snip...
102+
103+
```
104+
| METASPLOITABLE\tomcat55 (RID: 1220)
105+
| Flags: Account disabled, Normal user account
106+
| METASPLOITABLE\user (RID: 3002)
107+
| Full name: just a user,111,,
108+
| Flags: Normal user account
109+
| METASPLOITABLE\uucp (RID: 1020)
110+
| Full name: uucp
111+
| Flags: Account disabled, Normal user account
112+
| METASPLOITABLE\www-data (RID: 1066)
113+
| Full name: www-data
114+
|_ Flags: Account disabled, Normal user account
115+
116+
Nmap scan report for win2k (10.9.7.127)
117+
Host is up (0.0013s latency).
118+
PORT STATE SERVICE
119+
445/tcp open microsoft-ds
120+
MAC Address: 00:0C:29:C8:97:2D (VMware)
121+
122+
Host script results:
123+
| smb-enum-users:
124+
| WIN2K\disabled (RID: 1000)
125+
| Full name: disabled
126+
| Description: user account is disabled
127+
| Flags: Account disabled, Normal user account
128+
| WIN2K\Guest (RID: 501)
129+
| Description: Built-in account for guest access to the computer/domain
130+
| Flags: Password not required, Password does not expire, Account disabled, Normal user account
131+
| WIN2K\renamedAdministrator (RID: 500)
132+
| Description: Built-in account for administering the computer/domain
133+
| Flags: Password does not expire, Normal user account
134+
| WIN2K\test (RID: 1001)
135+
| Full name: test
136+
|_ Flags: Normal user account
137+
138+
Nmap done: 2 IP addresses (2 hosts up) scanned in 0.62 seconds
65139
```

‎documentation/modules/auxiliary/scanner/smb/smb_version.md

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,118 @@ msf auxiliary(smb_version) > run
5050
[*] 10.9.7.232:445 - Host is running Windows 7 Enterprise SP1 (build:7601) (name:IE11WIN7) (workgroup:WORKGROUP )
5151
[*] Scanned 254 of 254 hosts (100% complete)
5252
[*] Auxiliary module execution completed
53+
```
54+
55+
## Confirmation with nmap
56+
57+
There are several scripts that attempt to validate OS information through SMB. The most equivalent is [smb-os-discovery](https://nmap.org/nsedoc/scripts/smb-os-discovery.html).
58+
59+
```
60+
nmap --script smb-os-discovery.nse -p445 10.9.7.7,35,91,108,119,127,164,175,232
61+
62+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-19 14:12 EDT
63+
Nmap scan report for WIN-O712LQK2K69 (10.9.7.7)
64+
Host is up (0.0025s latency).
65+
PORT STATE SERVICE
66+
445/tcp open microsoft-ds
67+
MAC Address: 00:0C:29:28:DD:A0 (VMware)
68+
69+
Host script results:
70+
| smb-os-discovery:
71+
| OS: Windows Server 2008 R2 Standard 7600 (Windows Server 2008 R2 Standard 6.1)
72+
| OS CPE: cpe:/o:microsoft:windows_server_2008::-
73+
| Computer name: WIN-O712LQK2K69
74+
| NetBIOS computer name: WIN-O712LQK2K69\x00
75+
| Workgroup: WORKGROUP\x00
76+
|_ System time: 2017-05-19T11:12:15-07:00
77+
78+
Nmap scan report for 10.9.7.35
79+
Host is up (0.0018s latency).
80+
PORT STATE SERVICE
81+
445/tcp open microsoft-ds
82+
MAC Address: 00:0C:29:59:D4:F7 (VMware)
83+
84+
Host script results:
85+
| smb-os-discovery:
86+
| OS: Unix (Samba 3.0.20-Debian)
87+
| NetBIOS computer name:
88+
| Workgroup: WORKGROUP\x00
89+
|_ System time: 2017-05-19T14:33:31-04:00
90+
91+
Nmap scan report for IE11Win8_1 (10.9.7.91)
92+
Host is up (0.0020s latency).
93+
PORT STATE SERVICE
94+
445/tcp open microsoft-ds
95+
MAC Address: 00:0C:29:E0:CF:FB (VMware)
96+
97+
Host script results:
98+
| smb-os-discovery:
99+
| OS: Windows 8.1 Enterprise Evaluation 9600 (Windows 8.1 Enterprise Evaluation 6.3)
100+
| OS CPE: cpe:/o:microsoft:windows_8.1::-
101+
| NetBIOS computer name: IE11WIN8_1\x00
102+
| Workgroup: WORKGROUP\x00
103+
|_ System time: 2017-05-19T11:04:48-07:00
104+
105+
Nmap scan report for winxp (10.9.7.108)
106+
Host is up (0.0018s latency).
107+
PORT STATE SERVICE
108+
445/tcp open microsoft-ds
109+
MAC Address: 00:0C:29:D6:24:67 (VMware)
110+
111+
Host script results:
112+
| smb-os-discovery:
113+
| OS: Windows XP (Windows 2000 LAN Manager)
114+
| OS CPE: cpe:/o:microsoft:windows_xp::-
115+
| Computer name: winxp
116+
| NetBIOS computer name: WINXP\x00
117+
| Workgroup: RAGEGROUP\x00
118+
|_ System time: 2017-05-19T14:12:29-04:00
119+
120+
Nmap scan report for workNAS (10.9.7.119)
121+
Host is up (0.0024s latency).
122+
PORT STATE SERVICE
123+
445/tcp open microsoft-ds
124+
MAC Address: 00:11:32:10:FE:C4 (Synology Incorporated)
125+
126+
Host script results:
127+
| smb-os-discovery:
128+
| OS: Windows 6.1 (Samba 4.4.9)
129+
| Computer name: worknas
130+
| NetBIOS computer name: WORKNAS\x00
131+
| Domain name: \x00
132+
| FQDN: worknas
133+
|_ System time: 2017-05-19T14:12:41-04:00
134+
135+
Nmap scan report for win2k (10.9.7.127)
136+
Host is up (0.0025s latency).
137+
PORT STATE SERVICE
138+
445/tcp open microsoft-ds
139+
MAC Address: 00:0C:29:C8:97:2D (VMware)
140+
141+
Host script results:
142+
| smb-os-discovery:
143+
| OS: Windows 2000 (Windows 2000 LAN Manager)
144+
| OS CPE: cpe:/o:microsoft:windows_2000::-
145+
| Computer name: win2k
146+
| NetBIOS computer name: WIN2K\x00
147+
| Workgroup: WORKGROUP\x00
148+
|_ System time: 2017-05-19T14:04:37-04:00
149+
150+
Nmap scan report for IE11Win7 (10.9.7.232)
151+
Host is up (0.0019s latency).
152+
PORT STATE SERVICE
153+
445/tcp open microsoft-ds
154+
MAC Address: 00:0C:29:7D:29:4C (VMware)
155+
156+
Host script results:
157+
| smb-os-discovery:
158+
| OS: Windows 7 Enterprise 7601 Service Pack 1 (Windows 7 Enterprise 6.1)
159+
| OS CPE: cpe:/o:microsoft:windows_7::sp1
160+
| Computer name: IE11Win7
161+
| NetBIOS computer name: IE11WIN7\x00
162+
| Workgroup: WORKGROUP\x00
163+
|_ System time: 2017-05-19T11:04:46-07:00
164+
165+
Nmap done: 8 IP addresses (7 hosts up) scanned in 4.67 seconds
166+
53167
```

0 commit comments

Comments
 (0)