ETHNICAL HACKING

DISUSUN OLEH :
Rizki Cahya Sulistian 23.83.0997

PROGRAM STUDI TEKNIK KOMPUTER

FAKULTAS ILMU KOMPUTER UNIVERSITAS
AMIKOM YOGYAKARTA YOGYAKARTA
2025
Enumeration

Modul 04: Enumerasi

Skenario

Dengan perkembangan teknologi dan aplikasi jaringan, serangan jaringan sangat meningkat
baik dalam jumlah maupun tingkat keparahan. Penyerang terus mencari kerentanan layanan
dan aplikasi pada jaringan dan server. Ketika mereka menemukan celah atau kelemahan
dalam layanan yang berjalan melalui Internet, mereka segera memanfaatkannya untuk
mengkompromikan seluruh sistem. Data lain apa pun yang mereka temukan dapat digunakan
lebih lanjut untuk mengkompromikan sistem jaringan tambahan. Demikian pula, penyerang
mencari dan menggunakan workstation dengan hak administratif, dan yang menjalankan
aplikasi yang cacat, untuk menjalankan kode arbitrer atau menanamkan virus guna
mengintensifkan kerusakan pada jaringan.

Pada langkah pertama penilaian keamanan dan pengujian penetrasi organisasi Anda, Anda
mengumpulkan informasi sumber terbuka tentang organisasi Anda. Pada langkah kedua,
Anda mengumpulkan informasi tentang port dan layanan yang terbuka, OS (Sistem Operasi),
dan setiap kelalaian konfigurasi.

Langkah selanjutnya bagi ethical hacker atau penetration tester adalah menyelidiki jaringan
target lebih lanjut dengan melakukan enumerasi. Menggunakan berbagai teknik, Anda harus
mengekstrak detail lebih lanjut tentang jaringan seperti daftar komputer, nama pengguna,
grup pengguna, port, OS, nama mesin, sumber daya jaringan, dan layanan.

Informasi yang dikumpulkan dari enumerasi akan membantu Anda mengidentifikasi

kerentanan dalam keamanan sistem Anda yang akan dicari oleh penyerang untuk
dieksploitasi. Informasi tersebut juga dapat memungkinkan penyerang melakukan serangan
kata sandi untuk mendapatkan akses tidak sah ke sumber daya sistem informasi.

Pada langkah-langkah sebelumnya, Anda mengumpulkan informasi yang diperlukan tentang

target tanpa melanggar batas hukum apa pun. Namun, perlu diperhatikan bahwa aktivitas
enumerasi mungkin ilegal tergantung pada kebijakan organisasi dan hukum apa pun yang
berlaku di lokasi Anda. Sebagai ethical hacker atau penetration tester, Anda harus selalu
memperoleh otorisasi yang tepat sebelum melakukan enumerasi.

Tujuan

Tujuan dari lab ini adalah untuk mengekstrak informasi tentang organisasi target yang
meliputi, namun tidak terbatas pada:

 Nama mesin, OS, layanan, dan port-nya

 Sumber daya jaringan
 Nama pengguna dan grup pengguna
 Daftar share pada host individual di jaringan
 Kebijakan dan kata sandi
  Tabel routing
 Pengaturan audit dan layanan
 Detail SNMP dan FQDN

Ikhtisar Enumerasi

Enumerasi menciptakan koneksi aktif dengan sistem dan melakukan kueri terarah untuk
mendapatkan lebih banyak informasi tentang target. Ini mengekstrak daftar komputer, nama
pengguna, grup pengguna, port, OS, nama mesin, sumber daya jaringan, dan layanan
menggunakan berbagai teknik. Teknik enumerasi dilakukan di lingkungan intranet.

Tugas Lab

Ethical hacker atau penetration tester menggunakan beberapa alat dan teknik untuk
mengenumerasi jaringan target. Lab yang direkomendasikan yang akan membantu Anda
dalam mempelajari berbagai teknik enumerasi meliputi:

 Lakukan Enumerasi NetBIOS

o Lakukan enumerasi NetBIOS menggunakan utilitas baris perintah Windows
o Lakukan enumerasi NetBIOS menggunakan NetBIOS Enumerator
o Lakukan enumerasi NetBIOS menggunakan Skrip NSE
 Lakukan Enumerasi SNMP
o Lakukan enumerasi SNMP menggunakan snmp-check
o Lakukan enumerasi SNMP menggunakan SoftPerfect Network Scanner
o Lakukan enumerasi SNMP menggunakan SnmpWalk
o Lakukan enumerasi SNMP menggunakan Nmap
 Lakukan Enumerasi LDAP
o Lakukan enumerasi LDAP menggunakan Active Directory Explorer (AD
Explorer)
o Lakukan enumerasi LDAP menggunakan Python dan Nmap
o Lakukan enumerasi LDAP menggunakan ldapsearch
 Lakukan Enumerasi NFS
o Lakukan enumerasi NFS menggunakan RPCScan dan SuperEnum
 Lakukan Enumerasi DNS
o Lakukan enumerasi DNS menggunakan zone transfer
o Lakukan enumerasi DNS menggunakan DNSSEC zone walking
o Lakukan enumerasi DNS menggunakan Nmap
 Lakukan Enumerasi SMTP
o Lakukan enumerasi SMTP menggunakan Nmap
 Lakukan Enumerasi RPC, SMB, dan FTP
o Lakukan enumerasi SMB dan RPC menggunakan NetScanTools Pro
o Lakukan enumerasi RPC, SMB, dan FTP menggunakan Nmap
 Lakukan enumerasi menggunakan berbagai alat enumerasi
o Enumerasi informasi menggunakan Global Network Inventory
o Enumerasi sumber daya jaringan menggunakan Advanced IP Scanner
o Enumerasi informasi dari host Windows dan Samba menggunakan
Enum4linux
Lab 1: Lakukan Enumerasi NetBIOS

Skenario Lab

Sebagai ethical hacker atau penetration tester profesional, langkah pertama Anda dalam
enumerasi sistem Windows adalah mengeksploitasi NetBIOS API. Enumerasi NetBIOS
memungkinkan Anda mengumpulkan informasi tentang target seperti daftar komputer yang
termasuk dalam domain target, share pada host individual di jaringan target, kebijakan, kata
sandi, dll. Data ini dapat digunakan untuk menyelidiki mesin lebih lanjut untuk informasi
terperinci tentang sumber daya jaringan dan host.

Tujuan Lab

 Lakukan enumerasi NetBIOS menggunakan utilitas baris perintah Windows

 Lakukan enumerasi NetBIOS menggunakan NetBIOS Enumerator
 Lakukan enumerasi NetBIOS menggunakan Skrip NSE

Ikhtisar Enumerasi NetBIOS

NetBIOS adalah singkatan dari Network Basic Input Output System. Windows
menggunakan NetBIOS untuk berbagi file dan printer. Nama NetBIOS adalah nama
komputer unik yang ditetapkan ke sistem Windows, terdiri dari string ASCII 16 karakter
yang mengidentifikasi perangkat jaringan melalui TCP/IP. 15 karakter pertama digunakan
untuk nama perangkat, dan yang ke-16 dicadangkan untuk layanan atau tipe rekaman nama.

Layanan NetBIOS mudah ditargetkan, karena mudah dieksploitasi dan berjalan di sistem
Windows bahkan ketika tidak digunakan. Enumerasi NetBIOS memungkinkan penyerang
untuk membaca atau menulis ke sistem komputer jarak jauh (tergantung pada ketersediaan
share) atau meluncurkan serangan denial of service (DoS).

Tugas 1: Lakukan Enumerasi NetBIOS menggunakan Utilitas Baris Perintah

Windows

Nbtstat membantu dalam memecahkan masalah resolusi nama NETBIOS. Perintah nbtstat
menghapus dan memperbaiki entri yang dimuat sebelumnya menggunakan beberapa switch
yang sensitif huruf besar/kecil. Nbtstat dapat digunakan untuk mengenumerasi informasi
seperti statistik protokol NetBIOS over TCP/IP (NetBT), tabel nama NetBIOS untuk
komputer lokal dan jarak jauh, dan cache nama NetBIOS.

Net use menghubungkan komputer ke, atau memutuskan sambungannya dari, sumber daya
bersama. Ini juga menampilkan informasi tentang koneksi komputer.

Di sini, kita akan menggunakan utilitas baris perintah Windows Nbtstat dan Net use untuk
melakukan enumerasi NetBIOS pada jaringan target.
Di sini, kita akan menggunakan mesin Windows Server 2019 ([Link]) untuk
menargetkan mesin Windows 11 ([Link]).

1. Klik Windows Server 2019 untuk beralih ke mesin Windows Server 2019.
2. Klik Ctrl+Alt+Delete untuk mengaktifkan mesin. Secara default, profil pengguna
Administrator dipilih dan tekan Enter untuk masuk.
3. Layar Networks muncul, klik Yes untuk mengizinkan PC Anda ditemukan oleh PC
dan perangkat lain di jaringan.

4. Buka jendela Command Prompt (CMD).

5. Ketik perintah nbtstat -a [IP address of the remote machine] dengan IP address target
[Link], lalu tekan Enter:

a (adaptor) adalah switch yang digunakan untuk menentukan nama atau alamat IP dari
komputer jarak jauh dan menampilkan tabel nama NetBIOS-nya.

Hasilnya akan muncul, menampilkan tabel nama NetBIOS dari komputer jarak jauh (dalam
hal ini, mesin WINDOWS11).

6. Di jendela Command Prompt yang sama pada mesin Windows ketik perintah berikut nbtstat
-c, lalu tekan Enter

-c (cache) digunakan untuk menampilkan isi Cache Nama NetBIOS (NetBIOS Name Cache)
pada komputer lokal Anda.
7. Hasilnya akan muncul, menampilkan:

 Isi Cache Nama NetBIOS (NetBIOS Name Cache): Ini adalah tabel dari nama-
nama NetBIOS yang telah diselesaikan baru-baru ini.
 Alamat IP yang Diselesaikan: Alamat IP yang sesuai untuk setiap nama NetBIOS
dalam cache.

8. Di jendela Command Prompt yang sama pada mesin Windows ketik perintah berikut
net use lalu tekan Enter Output akan menampilkan informasi tentang target seperti
status koneksi, folder/drive bersama, dan informasi jaringan, seperti yang
ditunjukkan pada tangkapan layar. indo
 9. Dengan menggunakan informasi ini, penyerang dapat membaca atau menulis ke
sistem komputer jarak jauh, tergantung pada ketersediaan share, atau bahkan
melancarkan serangan DoS.
10. Ini menyimpulkan demonstrasi melakukan enumerasi NetBIOS menggunakan
utilitas baris perintah Windows seperti Nbtstat dan Net use.
11. Tutup semua jendela yang terbuka dan dokumentasikan semua informasi yang
diperoleh.

Task 2: Lakukan Enumerasi NetBIOS menggunakan

NetBIOS Enumerator
NetBIOS Enumerator adalah alat yang memungkinkan penggunaan dukungan jaringan jarak
jauh dan beberapa teknik lain seperti SMB (Server Message Block). Alat ini digunakan untuk
menghitung detail seperti nama NetBIOS, nama pengguna, nama domain, dan alamat MAC
untuk rentang alamat IP tertentu.

Di sini, kita akan menggunakan NetBIOS Enumerator untuk melakukan enumerasi NetBIOS
pada jaringan target.

Di sini, kita akan menggunakan komputer Windows 11 untuk menargetkan komputer

Windows Server 2019 dan Windows Server 2022.

1. Klik Windows 11 untuk beralih ke komputer Windows 11, lalu klik Ctrl+Alt+Delete.

Atau, Anda juga dapat mengklik tombol Ctrl+Alt+Delete di bawah gambar mini komputer
Windows 11 di panel Sumber Daya atau klik tombol Ctrl+Alt+Delete di bawah menu
Perintah (ikon guntur).

2. Secara default, profil pengguna Admin dipilih, ketik Pa$$w0rd di kolom Kata Sandi,
lalu tekan Enter untuk masuk.

Atau, Anda juga dapat mengeklik Pa$$w0rd di bawah gambar mini komputer Windows 11 di
panel Sumber Daya atau mengeklik tombol Ketik Teks | Ketik Kata Sandi di bawah menu
Perintah (ikon guntur).

Jika wizard Selamat Datang di Windows muncul, klik Lanjutkan dan di wizard Masuk
dengan Microsoft, klik Batal.

Layar Jaringan muncul, klik Ya agar PC Anda dapat ditemukan oleh PC dan perangkat lain di
jaringan.

3. Di komputer Windows 11, navigasikan ke E:\CEH-Tools\CEHv12 Module 04

Enumeration\NetBIOS Enumeration Tools\NetBIOS Enumerator dan klik dua kali
NetBIOS [Link].

Jika pop-up Open - File Security Warning muncul, klik Jalankan.

4. Jendela utama NetBIOS Enumerator akan muncul, seperti yang ditunjukkan pada
tangkapan layar.

5. Pada rentang IP yang akan dipindai, masukkan rentang IP di kolom "from" dan "to", lalu klik
tombol "Pindai" untuk memulai pemindaian (Dalam contoh ini, kami menargetkan rentang IP
[Link]-[Link]).

Pastikan alamat IP di kolom "to" berada di antara [Link] hingga [Link]. Jika alamat IP
kurang dari [Link], alat mungkin akan mengalami crash..

6. NetBIOS Enumerator memindai rentang alamat IP yang diberikan. Setelah selesai, hasil
pemindaian ditampilkan di panel kiri, seperti yang ditunjukkan pada tangkapan layar.

7. Bagian jendela Debug di panel kanan menampilkan rentang pemindaian alamat IP dan
menampilkan Siap! setelah pemindaian selesai. Pemindaian membutuhkan waktu sekitar 5
menit.
8. Klik ikon perluas (+) di sebelah kiri alamat IP [Link] dan [Link] di panel kiri jendela.
Kemudian, klik ikon perluas di sebelah kiri Nama NetBIOS untuk menampilkan detail NetBIOS dari
alamat IP target, seperti yang ditunjukkan pada tangkapan layar.
9. Demonstrasi enumerasi NetBIOS menggunakan NetBIOS Enumerator telah selesai. Informasi
NetBIOS yang telah dienumerasi ini dapat digunakan untuk menyusun strategi serangan terhadap
target.
10. Tutup semua jendela yang terbuka dan dokumentasikan semua informasi yang diperoleh.

Task 3: Perform NetBIOS Enumeration using an NSE

Script
NSE allows users to write (and share) simple scripts to automate a wide variety of networking tasks.
NSE scripts can be used for discovering NetBIOS shares on the network. Using the nbstat NSE script,
for example, you can retrieve the target’s NetBIOS names and MAC addresses. Moreover, increasing
verbosity allows you to extract all names related to the system.

Here, we will run the nbstat script to enumerate information such as the name of the computer and the
logged-in user.

1. Click Parrot Security to switch to the Parrot Security machine.

2. In the login page, the attacker username will be selected by default. Enter password as toor
in the Password field and press Enter to log in to the machine.

If a Parrot Updater pop-up appears at the top-right corner of Desktop, ignore and
close it.

If a Question pop-up window appears asking you to update the machine, click No to
close the window.
3. Click the MATE Terminal icon at the top of the Desktop to open a Terminal window.
4. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
5. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

6. In the terminal window, type nmap -sV -v --script [Link] [Target IP Address] (in this
example, the target IP address is [Link]) and press Enter.

-sV detects the service versions, -v enables the verbose output (that is, includes all
hosts and ports in the output), and --script [Link] performs the NetBIOS
enumeration.
7. The scan results appear, displaying the open ports and services, along with their versions.
Displayed under the Host script results section are details about the target system such as the
NetBIOS name, NetBIOS user, and NetBIOS MAC address, as shown in the screenshot.
8. In the terminal window, type nmap -sU -p 137 --script [Link] [Target IP Address] (in
this case, the target IP address is [Link]) and press Enter.

-sU performs a UDP scan, -p specifies the port to be scanned, and --script [Link]
performs the NetBIOS enumeration.
9. The scan results appear, displaying the open NetBIOS port (137) and, under the Host script
results section, NetBIOS details such as NetBIOS name, NetBIOS user, and NetBIOS MAC
of the target system, as shown in the screenshot.
 10. This concludes the demonstration of performing NetBIOS enumeration using an NSE script.
11. Other tools may also be used to perform NetBIOS enumeration on the target network such as
Global Network Inventory ([Link] Advanced IP Scanner
([Link] Hyena ([Link] and
Nsauditor Network Security Auditor ([Link]
12. Close all open windows and document all the acquired information.

Enumeration
2 Hr 24 Min Remaining

Lab 2: Perform SNMP Enumeration

Lab Scenario

As a professional ethical hacker or penetration tester, your next step is to carry out SNMP
enumeration to extract information about network resources (such as hosts, routers, devices, and
shares) and network information (such as ARP tables, routing tables, device-specific information, and
traffic statistics).

Using this information, you can further scan the target for underlying vulnerabilities, build a hacking
strategy, and launch attacks.
Lab Objectives

 Perform SNMP enumeration using snmp-check

 Perform SNMP enumeration using SoftPerfect Network Scanner
 Perform SNMP enumeration using SnmpWalk
 Perform SNMP enumeration using Nmap

Overview of SNMP Enumeration

SNMP (Simple Network Management Protocol) is an application layer protocol that runs on UDP
(User Datagram Protocol) and maintains and manages routers, hubs, and switches on an IP network.
SNMP agents run on networking devices on Windows and UNIX networks.

SNMP enumeration uses SNMP to create a list of the user accounts and devices on a target computer.
SNMP employs two types of software components for communication: the SNMP agent and SNMP
management station. The SNMP agent is located on the networking device, and the SNMP
management station communicates with the agent.

Task 1: Perform SNMP Enumeration using snmp-check

snmp-check is a tool that enumerates SNMP devices, displaying the output in a simple and reader-
friendly format. The default community used is “public.” As an ethical hacker or penetration tester, it
is imperative that you find the default community strings for the target device and patch them up.

Here, we will use the snmp-check tool to perform SNMP enumeration on the target IP address

We will use the Parrot Security ([Link]) machine to target the Windows Server 2022
([Link]) machine.

1. Click Parrot Security to switch to the Parrot Security machine.

2. In the login page, the attacker username will be selected by default. Enter password as toor
in the Password field and press Enter to log in to the machine.

If a Parrot Updater pop-up appears at the top-right corner of Desktop, ignore and
close it.

If a Question pop-up window appears asking you to update the machine, click No to
close the window.
3. Click the MATE Terminal icon at the top of the Desktop to open a Terminal window.

Before starting SNMP enumeration, we must first discover whether the SNMP port is
open. SNMP uses port 161 by default; to check whether this port is opened, we will
first run Nmap port scan.
4. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
5. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

6. Now, type cd and press Enter to jump to the root directory.

7. In the Parrot Terminal window, type nmap -sU -p 161 [Target IP address] (in this
example, the target IP address is [Link]) and press Enter.

-sU performs a UDP scan and -p specifies the port to be scanned.

8. The results appear, displaying that port 161 is open and being used by SNMP, as shown in the
screenshot.
9. We have established that the SNMP service is running on the target machine. Now, we shall
exploit it to obtain information about the target system.
10. In the Parrot Terminal window, type snmp-check [Target IP Address] (in this example,
the target IP address is [Link]) and press Enter.
11. The result appears as shown in the screenshot. It reveals that the extracted SNMP port 161 is
being used by the default “public” community string.

If the target machine does not have a valid account, no output will be displayed.

12. The snmp-check command enumerates the target machine, listing sensitive information such
as System information and User accounts.
13. Scroll down to view detailed information regarding the target network under the following
sections: Network information, Network interfaces, Network IP and Routing
information, and TCP connections and listening ports.
14. Similarly, scrolling down reveals further sensitive information on Processes, Storage
information, File system information, Device information, Share, etc.
 15. Attackers can further use this information to discover vulnerabilities in the target machine and
further exploit them to launch attacks.
16. This concludes the demonstration of performing SNMP enumeration using the snmp-check.
17. Close all open windows and document all the acquired information.

Task 2: Perform SNMP Enumeration using SoftPerfect

Network Scanner
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, and retrieve
practically any information about network devices via WMI (Windows Management
Instrumentation), SNMP, HTTP, SSH, and PowerShell.

The program also scans for remote services, registries, files, and performance counters. It can check
for a user-defined port and report if one is open, and is able to resolve hostnames as well as auto-
detect your local and external IP range. SoftPerfect Network Scanner offers flexible filtering and
display options, and can export the NetScan results to a variety of formats, from XML to JSON. In
addition, it supports remote shutdown and Wake-On-LAN.

Here, we will use the SoftPerfect Network Scanner to perform SNMP enumeration on a target system.

1. Click Windows Server 2019 to switch to the Windows Server 2019 machine.
 If you are logged out of the Windows Server 2019 machine, click Ctrl+Alt+Delete,
then login into Administrator user profile using Pa$$w0rd as password.

2. Click Search icon ( ) on the Desktop. Type network in the search field, the Network
Scanner appears in the results, select Network Scanner to launch it.

If a User Account Control pop-up appears, click Yes.

3. When the Welcome to the Network Scanner! wizard appears, click Continue.
4. The SoftPerfect Network Scanner GUI window will appear, as shown in the screenshot.
5. Click on the Options menu, and select Remote SNMP… from the drop down list. The
SNMP pop-up window will appear.
6. Click the Mark All/None button to select all the items available for SNMP scanning and
close the window.
7. To scan your network, enter an IP range in the IPv4 From and To fields (in this example, the
target IP address range is [Link]-[Link]), and click the Start Scanning button.
8. The status bar at the lower-right corner of the GUI displays the status of the scan.
9. The scan results appear, displaying the active hosts in the target IP address range, as shown in
the screenshot.
10. To view the properties of an individual IP address, right-click a particular IP address (in this
example, [Link]) and select Properties, as shown in the screenshot.
11. The Properties window appears, displaying the Shared Resources, IP Address, MAC
Address, Response Time, Host Name, Uptime, and System Description of the machine
corresponding to the selected IP address.
12. Close the Properties window.
13. To view the shared folders, note the scanned hosts that have a + node before them. Expand
the node to view all the shared folders.

In this example, we are targeting the Windows Server 2022 machine ([Link]).
14. Right-click the selected host, and click Open Device. A drop-down list appears, containing
options that allow you to connect to the remote machine over HTTP, HTTPS, FTP, and
Telnet.
 If the selected host is not secure enough, you may use these options to connect to the
remote machines. You may also be able to perform activities such as sending a
message and shutting down a computer remotely. These features are applicable only
if the selected machine has a poor security configuration.

15. This concludes the demonstration of performing SNMP enumeration using the SoftPerfect
Network Scanner.
16. You can also use other SNMP enumeration tools such as Network Performance Monitor
([Link] OpUtils ([Link] PRTG Network
Monitor ([Link] and Engineer’s Toolset ([Link]
to perform SNMP enumeration on the target network.
17. Close all open windows and document all the acquired information.

Task 3: Perform SNMP Enumeration using SnmpWalk

SnmpWalk is a command line tool that scans numerous SNMP nodes instantly and identifies a set of
variables that are available for accessing the target network. It is issued to the root node so that the
information from all the sub nodes such as routers and switches can be fetched.

Here, we will use SnmpWalk to perform SNMP enumeration on a target system.

1. Click Parrot Security to switch to the Parrot Security machine.

2. Click the MATE Terminal icon at the top of the Desktop to open a Terminal window.

3. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
4. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

5. Type snmpwalk -v1 -c public [target IP] and press Enter (here, the target IP address is
[Link]).

–v: specifies the SNMP version number (1 or 2c or 3) and –c: sets a community
string.

6. The result displays all the OIDs, variables and other associated information.
7. Type snmpwalk -v2c -c public [Target IP Address] and press Enter to perform SNMPv2
enumeration on the target machine (here, the target IP address is [Link]).

–v: specifies the SNMP version (here, 2c is selected) and –c: sets a community string.
 8. The result displays data transmitted from the SNMP agent to the SNMP server, including
information on server, user credentials, and other parameters.
9. This concludes the demonstration of performing SNMP enumeration using the SnmpWalk.
10. Close all open windows and document all the acquired information.

Task 4: Perform SNMP Enumeration using Nmap

The Nmap snmp script is used against an SNMP remote server to retrieve information related to the
hosted SNMP services.

Here, we will use various Nmap scripts to perform SNMP enumeration on the target system.

Here, we will perform SNMP enumeration on a target machine Windows Server 2022 ([Link]).

1. In the Parrot Security machine, click the MATE Terminal icon at the top-left corner of
Desktop to launch a Terminal window.
2. In the terminal window, type sudo su and press Enter to run the programs as a root user.
3. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

4. In the terminal, type nmap -sU -p 161 --script=snmp-sysdescr [target IP Address] and
press Enter (here, the target IP address is [Link]).

-sU: specifies a UDP scan, -p: specifies the port to be scanned, and -–script: is an
argument used to execute a given script (here, snmp-sysdescr).

5. The result appears displaying information regarding SNMP server type and operating system
details, as shown in the screenshot below.
6. Type nmap -sU -p 161 --script=snmp-processes [target IP Address] and press Enter (here,
the target IP address is [Link]).

-sU: specifies UDP scan, -p: specifies the port to be scanned, and -–script: is an
argument used to execute a given script (here, snmp-processes).

7. The result appears displaying a list of all the running SNMP processes along with the
associated ports on the target machine (here, Windows Server 2022), as shown in the
screenshot below.
8. Type nmap -sU -p 161 --script=snmp-win32-software [target IP Address] and press Enter
(here, the target IP address is [Link]).

-sU: specifies UDP scan, -p: specifies the port to be scanned, and -–script: argument
used to execute a given script (here, the script is snmp-win32-software).

9. The result appears displaying a list of all the applications running on the target machine (here,
Windows Server 2022), as shown in the screenshot.
10. Type nmap -sU -p 161 --script=snmp-interfaces [target IP Address] and press Enter (here
the target IP address is [Link]).

-sU specifies a UDP scan, -p specifies the port to be scanned, and -–script is an
argument allows us to run a given script (here, snmp-interfaces).

11. The result appears displaying information about the Operating system, network interfaces,
and applications that are installed on the target machine (here, Windows Server 2022), as
shown in the screenshot below.
 12. This concludes the demonstration of performing SNMP enumeration using Nmap.
13. Close all open windows and document all the acquired information.

Enumeration
2 Hr 24 Min Remaining

Lab 3: Perform LDAP Enumeration

Lab Scenario

As a professional ethical hacker or penetration tester, the next step after SNMP enumeration is to
perform LDAP enumeration to access directory listings within Active Directory or other directory
services. Directory services provide hierarchically and logically structured information about the
components of a network, from lists of printers to corporate email directories. In this sense, they are
similar to a company’s org chart.

LDAP enumeration allows you to gather information about usernames, addresses, departmental
details, server names, etc.

Lab Objectives

 Perform LDAP enumeration using Active Directory Explorer (AD Explorer)

  Perform LDAP enumeration using Python and Nmap
 Perform LDAP enumeration using ldapsearch

Overview of LDAP Enumeration

LDAP (Lightweight Directory Access Protocol) is an Internet protocol for accessing distributed
directory services over a network. LDAP uses DNS (Domain Name System) for quick lookups and
fast resolution of queries. A client starts an LDAP session by connecting to a DSA (Directory System
Agent), typically on TCP port 389, and sends an operation request to the DSA, which then responds.
BER (Basic Encoding Rules) is used to transmit information between the client and the server. One
can anonymously query the LDAP service for sensitive information such as usernames, addresses,
departmental details, and server names.

Task 1: Perform LDAP Enumeration using Active

Directory Explorer (AD Explorer)
Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. It
can be used to navigate an AD database easily, define favorite locations, view object properties and
attributes without having to open dialog boxes, edit permissions, view an object’s schema, and
execute sophisticated searches that can be saved and re-executed.

Here, we will use the AD Explorer to perform LDAP enumeration on an AD domain and modify the
domain user accounts.

1. Click Windows Server 2019 to switch to the Windows Server 2019 machine.
2. Click Ctrl+Alt+Delete to activate the machine. By default, Administrator user profile is
selected, type Pa$$w0rd in the Password field and press Enter to login.
3. Navigate to Z:\CEHv12 Module 04 Enumeration\LDAP Enumeration Tools\Active
Directory Explorer and double-click [Link].
4. The Active Directory Explorer License Agreement window appears; click Agree.
5. The Connect to Active Directory pop-up appears; type the IP address of the target in the
Connect to field (in this example, we are targeting the Windows Server 2022 machine:
[Link]) and click OK.
6. The Active Directory Explorer displays the active directory structure in the left pane, as
shown in the screenshot.
7. Now, expand DC=CEH, DC=com, and CN=Users by clicking “+” to explore domain user
details.
8. Click any username (in the left pane) to display its properties in the right pane.
9. Right-click any attribute in the right pane (in this case, displayName) and click Modify…
from the context menu to modify the user’s profile.
10. The Modify Attribute window appears. First, select the username under the Value section,
and then click the Modify… button. The Edit Value pop-up appears. Rename the username
in the Value data field and click OK to save the changes.
 11. You can read and modify other user profile attributes in the same way.
12. This concludes the demonstration of performing LDAP enumeration using AD Explorer.
13. You can also use other LDAP enumeration tools such as Softerra LDAP Administrator
([Link] LDAP Admin Tool ([Link]
LDAP Account Manager ([Link] and LDAP Search
([Link] to perform LDAP enumeration on the target.
14. Close all open windows and document all the acquired information.

Task 2: Perform LDAP Enumeration using Python and

Nmap
LDAP enumeration can be performed using both manual and automated methods. Using various
Python commands LDAP enumeration is performed on the target host to obtain information such as
domains, naming context, directory objects, etc. Using NSE script can be used to perform queries to
brute force LDAP authentication using the built-in username and password lists.

Here, we will use Nmap and Python commands to extract details on the LDAP server and connection.

1. Click Parrot Security to switch to the Parrot Security machine.

2. Click the MATE Terminal icon at the top-left corner of the Desktop to open a Terminal
window.
3. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
4. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

5. In the Parrot Terminal window, type nmap -sU -p 389 [Target IP address] (here, the target
IP address is [Link]) and press Enter.

-sU: performs a UDP scan and -p: specifies the port to be scanned.

6. The results appear, displaying that the port 389 is open and being used by LDAP, as shown in
the screenshot below.
7. Now, we will use NSE script to perform username enumeration on the target machine
Windows Server 2022 ([Link]).
8. Type nmap -p 389 --script ldap-brute --script-args
[Link]='"cn=users,dc=CEH,dc=com"' [Target IP Address] (here, the target IP address
is [Link]) and press Enter.

-p: specifies the port to be scanned, ldap-brute: to perform brute-force LDAP

authentication. [Link]: if set, the script will use it as a base for the password
guessing attempts.
9. Nmap attempts to brute-force LDAP authentication and displays the usernames that are
found, as shown in the screenshot below.
10. Close the terminal window. Now, we will perform manual LDAP Enumeration using Python.
11. Click the MATE Terminal icon at the top-left corner of the Desktop to open a Terminal
window.
12. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
13. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

14. Type python3 and press Enter to open a python3 shell.
15. Type import ldap3 and press Enter to import LDAP.
16. Now, we will connect to the target LDAP server without credentials using python.
17. Type server=[Link](’[Target IP Address]’, get_info=[Link],port=[Target
Port]) and press Enter to provide the target IP address and port number (here, the target IP
address is [Link], and the port number is 389).
18. In the python3 shell, type connection=[Link](server) and press Enter.
19. Type [Link]() and press Enter to bind the connection. We will receive response as
True which means the connection is established successfully
20. Type [Link] and press Enter to gather information such as naming context or domain
name, as shown in the screenshot below.
21. After receiving the naming context, we can make more queries to the server to extract more
information.
22. In the terminal window, type [Link](search_base='DC=CEH,DC=com',
search_filter='(&(objectclass=*))', search_scope='SUBTREE', attributes='*') and press
Enter.
23. Type [Link] and press Enter to retrieve all the directory objects.
24. In the python3 shell, type [Link](search_base='DC=CEH,DC=com',
search_filter='(&(objectclass=person))', search_scope='SUBTREE',
attributes='userpassword') and press Enter. True response indicates that the query is
successfully executed.
25. Type [Link] and press Enter to dump the entire LDAP information.
 26. Using this information attackers can launch web application attacks and they can also gain
access to the target machine.
27. This concludes the demonstration of LDAP enumeration using Nmap and Python.
28. Close all open windows and document all the acquired information.

Task 3: Perform LDAP Enumeration using ldapsearch

ldapsearch is a shell-accessible interface to the ldap_search_ext(3) library call. ldapsearch opens a
connection to an LDAP server, binds the connection, and performs a search using the specified
parameters. The filter should conform to the string representation for search filters as defined in RFC
4515. If not provided, the default filter, (objectClass=*), is used.

Here, we will use ldapsearch to perform LDAP enumeration on the target system.

1. In Parrot Security machine, click the MATE Terminal icon at the top-left corner of the
Desktop to open a Terminal window.
2. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
3. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

4. In the terminal, type ldapsearch -h [Target IP Address] -x -s base namingcontexts and
press Enter (here, the target IP address is [Link]), to gather details related to the naming
contexts.

-x: specifies simple authentication, -h: specifies the host, and -s: specifies the scope.
5. Type ldapsearch -h [Target IP Address] -x -b “DC=CEH,DC=com” and press Enter
(here, the target IP address is [Link]), to obtain more information about the primary
domain.

-x: specifies simple authentication, -h: specifies the host, and -b: specifies the base
DN for search.
6. Type ldapsearch -x -h [Target IP Address] -b "DC=CEH,DC=com" "objectclass=*" and
press Enter (here, the target IP address is [Link]), to retrieve information related to all the
objects in the directory tree.

-x: specifies simple authentication, -h: specifies the host, and -b: specifies the base
DN for search.
 7. Attackers use ldapsearch for enumerating AD users. It allows attackers to establish
connection with an LDAP server to carry out different searches using specific filters.
8. This concludes the demonstration of performing LDAP enumeration using ldapsearch.
9. Close all open windows and document all the acquired information.

Enumeration
2 Hr 22 Min Remaining

Lab 4: Perform NFS Enumeration

Lab Scenario

As a professional ethical hacker or penetration tester, the next step after LDAP enumeration is to
perform NFS enumeration to identify exported directories and extract a list of clients connected to the
server, along with their IP addresses and shared data associated with them.

After gathering this information, it is possible to spoof target IP addresses to gain full access to the
shared files on the server.

Lab Objectives

 Perform NFS enumeration using RPCScan and SuperEnum

Overview of NFS Enumeration

NFS (Network File System) is a type of file system that enables computer users to access, view, store,
and update files over a remote server. This remote data can be accessed by the client computer in the
same way that it is accessed on the local system.

Task 1: Perform NFS Enumeration using RPCScan and

SuperEnum
RPCScan communicates with RPC (remote procedure call) services and checks misconfigurations on
NFS shares. It lists RPC services, mountpoints,and directories accessible via NFS. It can also
recursively list NFS shares. SuperEnum includes a script that performs a basic enumeration of any
open port, including the NFS port (2049).

Here, we will use RPCScan and SuperEnum to enumerate NFS services running on the target
machine.

Before starting this task, it is necessary to enable the NFS service on the target machine (Windows
Server 2019). This will be done in Steps 1-6.

1. Click Windows Server 2019 to switch to the Windows Server 2019 machine. In the
Windows Server 2019 machine, click the Start button at the bottom-left corner of Desktop
and open Server Manager.

If you are logged out of the Windows Server 2019 machine, click Ctrl+Alt+Delete,
then login into Administrator user profile using Pa$$w0rd as password.

2. The Server Manager main window appears. By default, Dashboard will be selected; click
Add roles and features.
3. The Add Roles and Features Wizard window appears. Click Next here and in the
Installation Type and Server Selection wizards.
4. The Server Roles section appears. Expand File and Storage Services and select the
checkbox for Server for NFS under the File and iSCSI Services option, as shown in the
screenshot. Click Next.

In the Add features that are required for Server for NFS? pop-up window, click
the Add Features button.
5. In the Features section, click Next. The Confirmation section appears; click Install to install
the selected features.
6. The features begin installing, with progress shown by the Feature installation status bar.
When installation completes, click Close.
7. Having enabled the NFS service, it is necessary to check if it is running on the target system
(Windows Server 2019). In order to do this, we will use Parrot Security machine.
8. Click Parrot Security to switch to the Parrot Security machine.
9. Click the MATE Terminal icon at the top-left corner of the Desktop to open a Terminal
window.
10. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
11. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

12. In the terminal window, type nmap -p 2049 [Target IP Address] (here the target IP address
is , [Link]) and press Enter.

-p: specifies port.

13. The scan result appears indicating that port 2049 is opened, and the NFS service is running on
it, as shown in the screenshot.
14. Type cd SuperEnum and press Enter to navigate to the SuperEnum folder.
15. Type echo "[Link]" >> [Link] and press Enter to create a file having a target
machine's IP address ([Link]).

You may enter multiple IP addresses in the [Link] file. However, in this task we
are targeting only one machine, the Windows Server 2019 ([Link]).
16. Type ./superenum and press Enter. Under Enter IP List filename with path, type
[Link], and press Enter.

If you get an error running the ./superenum script, type chmod +x superenum and
press Enter, then repeat Step 16.
17. The script starts scanning the target IP address for open NFS and other.

The scan will take approximately 15-20 mins to complete.

18. After the scan is finished, scroll down to review the results. Observe that the port 2049 is
open and the NFS service is running on it.
19. You can also observe the other open ports and the services running on them.
20. In the terminal window, type cd .. and press Enter to return to the root directory.
21. Now, we will perform NFS enumeration using RPCScan. To do so, type cd RPCScan and
press Enter
22. Type python3 [Link] [Target IP address] --rpc (in this case, the target IP address is
[Link], the Windows Server 2019 machine); press Enter.

--rpc: lists the RPC (portmapper).

23. The result appears, displaying that port 2049 is open, and the NFS service is running on it.
 24. This concludes the demonstration of performing NFS enumeration using SuperEnum and
RPCScan.
25. Close all open windows and document all the acquired information.

Enumeration
2 Hr 22 Min Remaining

Lab 5: Perform DNS Enumeration

Lab Scenario

As a professional ethical hacker or penetration tester, the next step after NFS enumeration is to
perform DNS enumeration. This process yields information such as DNS server names, hostnames,
machine names, usernames, IP addresses, and aliases assigned within a target domain.

Lab Objectives

 Perform DNS enumeration using zone transfer

 Perform DNS enumeration using DNSSEC zone walking
 Perform DNS enumeration using Nmap

Overview of DNS Enumeration

DNS enumeration techniques are used to obtain information about the DNS servers and network
infrastructure of the target organization. DNS enumeration can be performed using the following
techniques:

 Zone transfer
 DNS cache snooping
 DNSSEC zone walking

Task 1: Perform DNS Enumeration using Zone Transfer

DNS zone transfer is the process of transferring a copy of the DNS zone file from the primary DNS
server to a secondary DNS server. In most cases, the DNS server maintains a spare or secondary
server for redundancy, which holds all information stored in the main server.

If the DNS transfer setting is enabled on the target DNS server, it will give DNS information; if not, it
will return an error saying it has failed or refuses the zone transfer.

Here, we will perform DNS enumeration through zone transfer by using the dig (Linux-based
systems) and nslookup (Windows-based systems) utilities.

1. We will begin with DNS enumeration of Linux DNS servers.

2. In the Parrot Security machine, click the MATE Terminal icon at the top-left corner of the
Desktop to open a Terminal window.
3. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
4. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

5. Now, type cd and press Enter to jump to the root directory.

6. In the terminal window, type dig ns [Target Domain] (in this case, the target domain is
[Link]); press Enter.

In this command, ns returns name servers in the result

7. The above command retrieves information about all the DNS name servers of the target
domain and displays it in the ANSWER SECTION, as shown in the screenshot.

On Linux-based systems, the dig command is used to query the DNS name servers to
retrieve information about target host addresses, name servers, mail exchanges, etc.
8. In the terminal window, type dig @[[NameServer]] [[Target Domain]] axfr (in this
example, the name server is [Link] and the target domain is
[Link]); press Enter.

In this command, axfr retrieves zone information.

9. The result appears, displaying that the server is available, but that the Transfer failed., as
shown in the screenshot.
10. After retrieving DNS name server information, the attacker can use one of the servers to test
whether the target DNS allows zone transfers or not. In this case, zone transfers are not
allowed for the target domain; this is why the command resulted in the message: Transfer
failed. A penetration tester should attempt DNS zone transfers on different domains of the
target organization.
11. Now, we will perform DNS enumeration on Windows DNS servers.
12. Click Windows 11 to switch to the Windows 11 machine.

13. Click Search icon ( ) on the Desktop. Type cmd in the search field, the Command
Prompt appears in the results, click Open to launch it.
14. The Command Prompt window appears; type nslookup, and press Enter.
15. In the nslookup interactive mode, type set querytype=soa, and press Enter.
16. Type the target domain [Link] and press Enter. This resolves the target
domain information.

set querytype=soa sets the query type to SOA (Start of Authority) record to retrieve
administrative information about the DNS zone of the target domain
[Link].

17. The result appears, displaying information about the target domain such as the primary name
server and responsible mail addr, as shown in the screenshot.
18. In the nslookup interactive mode, type ls -d [Name Server] (in this example, the name is
[Link]) and press Enter, as shown in the screenshot.

In this command, ls -d requests a zone transfer of the specified name server.

19. The result appears, displaying that the DNS server refused the zone transfer, as shown in the
screenshot.
 20. After retrieving DNS name server information, the attacker can use one of the servers to test
whether the target DNS allows zone transfers or not. In this case, the zone transfer was
refused for the target domain. A penetration tester should attempt DNS zone transfers on
different domains of the target organization.
21. This concludes the demonstration of performing DNS zone transfer using dig and nslookup
commands.
22. Close all open windows and document all the acquired information.

Task 2: Perform DNS Enumeration using DNSSEC Zone

Walking
DNSSEC zone walking is a DNS enumeration technique that is used to obtain the internal records of
the target DNS server if the DNS zone is not properly configured. The enumerated zone information
can assist you in building a host network map.

There are various DNSSEC zone walking tools that can be used to enumerate the target domain’s
DNS record files.

Here, we will use the DNSRecon tool to perform DNS enumeration through DNSSEC zone walking.
1. Click Parrot Security to switch to the Parrot Security machine, click the MATE Terminal
icon at the top-left corner of Desktop to open a Terminal window.
2. In the terminal window, type sudo su and press Enter to run the programs as a root user.
3. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

4. Type cd dnsrecon and press Enter to enter in to dnsrecon directory.

5. Type chmod +x ./[Link] in the terminal and press Enter.
6. Type ./[Link] -h and press Enter to view all the available options in the DNSRecon
tool.
7. Type ./[Link] -d [Target domain] -z (here, the target domain is
[Link]); press Enter.

In this command, -d specifies the target domain and -z specifies that the DNSSEC
zone walk be performed with standard enumeration.

8. The result appears, displaying the enumerated DNS records for the target domain. In this case,
DNS record file A is enumerated, as shown in the screenshot.
 9. Using the DNSRecon tool, the attacker can enumerate general DNS records for a given
domain (MX, SOA, NS, A, AAAA, SPF, and TXT). These DNS records contain digital
signatures based on public-key cryptography to strengthen authentication in DNS.
10. This concludes the demonstration of performing DNS Enumeration using DNSSEC zone
walking.
11. You can also use other DNSSEC zone enumerators such as LDNS ([Link]
nsec3map ([Link] nsec3walker ([Link] and DNSwalk
([Link] to perform DNS enumeration on the target domain.
12. Close all open windows and document all the acquired information.

Task 3: Perform DNS Enumeration using Nmap

Nmap can be used for scanning domains and obtaining a list of subdomains, records, IP addresses,
and other valuable information from the target host.

Here, we will use nmap to perform DNS enumeration on the target system.

1. In the Parrot Security machine, click the MATE Terminal icon at the top-left corner of
Desktop to open a Terminal window.
2. In the terminal window, type sudo su and press Enter to run the programs as a root user.
3. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

4. In the terminal window, type nmap --script=broadcast-dns-service-discovery [Target
Domain] and press Enter (here, the target domain is [Link]).
5. The result appears displaying a list of all the available DNS services on the target host along
with their associated ports, as shown in the screenshot below.
6. Type nmap -T4 -p 53 --script dns-brute [Target Domain] and press Enter (here the target
domain is [Link]).

-T4: specifies the timing template, -p: specifies the target port.

7. The result appears displaying a list of all the subdomains associated with the target host along
with their IP addresses, as shown in the screenshot below.
8. Type nmap --script dns-srv-enum --script-args "[Link]='[Target
Domain]'” (here, the target domain is [Link]).
9. The result appears displaying various common service (SRV) records for a given domain
name, as shown in the screenshot below.
 10. Using this information, attackers can launch web application attacks such as injection attacks,
brute-force attacks and DoS attacks on the target domain.
11. This concludes the demonstration of performing DNS Enumeration using Nmap.
12. Close all open windows and document all the acquired information.

Enumeration
2 Hr 22 Min Remaining

Lab 6: Perform SMTP Enumeration

Lab Scenario

As an ethical hacker or penetration tester, the next step is to perform SMTP enumeration. SMTP
enumeration is performed to obtain a list of valid users, delivery addresses, message recipients on an
SMTP server.

Lab Objectives

 Perform SMTP enumeration using Nmap

Overview of SMTP Enumeration

The Simple Mail Transfer Protocol (SMTP) is an internet standard based communication protocol for
electronic mail transmission. Mail systems commonly use SMTP with POP3 and IMAP, which enable
users to save messages in the server mailbox and download them from the server when necessary.
SMTP uses mail exchange (MX) servers to direct mail via DNS. It runs on TCP port 25, 2525, or 587.

Task 1: Perform SMTP Enumeration using Nmap

The Nmap scripting engine can be used to enumerate the SMTP service running on the target system,
to obtain information about all the user accounts on the SMTP server.

Here, we will use the Nmap to perform SMTP enumeration.

1. In the Parrot Security machine, click the MATE Terminal icon at the top-left corner of
Desktop to open a Terminal window.

2. In the terminal window, type sudo su and press Enter to run the programs as a root user.
3. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

4. In the terminal window, type nmap -p 25 --script=smtp-enum-users [Target IP Address]
and press Enter, (here, the target IP address is [Link]).

-p: specifies the port, and –script: argument is used to run a given script (here, the
script is smtp-enum-users).

5. The result appears displaying a list of all the possible mail users on the target machine
([Link]), as shown in the screenshot below.
6. Type nmap -p 25 --script=smtp-open-relay [Target IP Address] and press Enter, (here,
the target IP address is [Link]).

-p: specifies the port, and –script: argument is used to run a given script (here, the
script is smtp-open-relay).

7. The result appears displaying a list of open SMTP relays on the target machine ([Link]),
as shown in the screenshot below.
8. Type nmap -p 25 --script=smtp-commands [Target IP Address] and press Enter, (here,
the target IP address is [Link]).

-p: specifies the port, and –script: argument is used to run a given script (here, the
script is smtp-commands).

9. A list of all the SMTP commands available in the Nmap directory appears. You can further
explore the commands to obtain more information on the target host.
 10. Using this information, the attackers can perform password spraying attacks to gain
unauthorized access to the user accounts.
11. This concludes the demonstration of SMTP enumeration using Nmap.
12. Close all open windows and document all the acquired information.

Enumeration
2 Hr 21 Min Remaining

Lab 7: Perform RPC, SMB, and FTP

Enumeration
Lab Scenario

As an ethical hacker or penetration tester, you should use different enumeration techniques to obtain
as much information as possible about the systems in the target network. This lab will demonstrate
various techniques for extracting detailed information that can be used to exploit underlying
vulnerabilities in target systems, and to launch further attacks.

Lab Objectives

 Perform SMB and RPC enumeration using NetScanTools Pro

  Perform RPC, SMB, and FTP enumeration using Nmap

Overview of Other Enumeration Techniques

Besides the methods of enumeration covered so far (NetBIOS, SNMP, LDAP, NFS, and DNS),
various other techniques such as RPC, SMB, and FTP enumeration can be used to extract detailed
network information about the target.

 RPC Enumeration: Enumerating RPC endpoints enables vulnerable services on these

service ports to be identified
 SMB Enumeration: Enumerating SMB services enables banner grabbing, which obtains
information such as OS details and versions of services running
 FTP Enumeration: Enumerating FTP services yields information about port 21 and any
running FTP services; this information can be used to launch various attacks such as FTP
bounce, FTP brute force, and packet sniffing

Task 1: Perform SMB and RPC Enumeration using

NetScanTools Pro
NetScanTools Pro is an integrated collection of Internet information-gathering and network-
troubleshooting utilities for network professionals. The utility makes it easy to find IPv4/IPv6
addresses, hostnames, domain names, email addresses, and URLs related to the target system.

Here, we will use the NetScanTools Pro tool to perform SMB enumeration.

Before starting this lab, it is necessary to enable the NFS service on the target machine (Windows
Server 2019). This will be done in Steps 1-6.

1. Click Windows Server 2019 to switch to the Windows Server 2019 machine. Click the Start
button at the bottom-left corner of Desktop and open Server Manager.

If you are logged out of the Windows Server 2019 machine, click Ctrl+Alt+Delete,
then login into Administrator user profile using Pa$$w0rd as password.

2. The Server Manager main window appears. By default, Dashboard will be selected; click
Add roles and features.
3. The Add Roles and Features Wizard window appears. Click Next here and in the
Installation Type and Server Selection wizards.
4. The Server Roles section appears. Expand File and Storage Services and select the
checkbox for Server for NFS under the File and iSCSI Services option, as shown in the
screenshot. Click Next.

In the Add features that are required for Server for NFS? pop-up window, click
the Add Features button.
5. In the Features section, click Next. The Confirmation section appears; click Install to install
the selected features.
6. The features begin installing, with progress shown by the Feature installation status bar.
When installation completes, click Close.
7. Click Windows 11 to switch to the Windows 11 machine.
8. Navigate to E:\CEH-Tools\CEHv12 Module 03 Scanning Networks\Scanning Tools\
NetScanTools Pro and double-click [Link].

If a User Account Control pop-up appears, click Yes.

9. The Setup - NetScanTools Pro Demo window appears click Next and follow the wizard-
driven installation steps to install NetScanTools Pro.

If a WinPcap 4.1.3 Setup pop-up appears, click Cancel.

10. In the Completing the NetScanTools Pro Demo Setup Wizard, ensure that Launch
NetScanTools Pro Demo is checked and click Finish.
11. The Reminder window appears; if you are using a demo version of NetScanTools Pro, click
the Start the DEMO button.
12. A DEMO Version pop-up appears; click the Start NetScanTools Pro Demo… button.
13. The NetScanTools Pro main window appears, as shown in the screenshot.
14. In the left pane, under the Manual Tools (all) section, scroll down and click the SMB
Scanner option, as shown in the screenshot.

If a dialog box appears explaining the tool, click OK.

15. In the right pane, click the Start SMB Scanner (external App) button.

If the Demo Version Message pop-up appears, click OK. In the Reminder window,
click Start the DEMO.
16. The SMB Scanner window appears; click the Edit Target List button.
17. The Edit Target List window appears. In the Hostname or IPv4 Address field, enter the
target IP address ([Link], in this example). Click the Add to List button to add the target
IP address to Target List.
18. Similarly, add another target IP address ([Link], in this example) to Target List and click
OK.

In this task, we are targeting the Windows Server 2019 ([Link]) and Windows
Server 2022 ([Link]) machines.
19. Now, click Edit Share Login Credentials to add credentials to access the target systems.
20. The Login Credentials List for Share Checking window appears. Enter Administrator and
Pa$$w0rd in the Username and Password fields, respectively. Click Add to List to add the
credentials to the list and click OK.

In this task, we are using the login credentials for the Windows Server 2019 and
Windows Server 2022 machines to understand the tool. In real-time, attackers may
add a list of login credentials by which they can log in to the target machines and
obtain the required SMB share information.
21. In the SMB Scanner window, click the Get SMB Versions button.
22. Once the scan is complete, the result appears, displaying information such as the NetBIOS
Name, DNS Name, SMB versions, and Shares for each target IP address.
23. Right-click on any of the machines (in this example, we will use [Link]) and click View
Shares from the available options.
24. The Shares for [Link] window appears, displaying detailed information about shared
files such as Share Name, Type, Remark, Path, Permissions, and Credentials Used. Close the
Shares for [Link] window.
 By using this information, attackers can perform various attacks such as SMB relay
attacks and brute-force attacks on the target system.

25. You can view the details of the shared files for the target IP address [Link] in the same
way.
26. In the left pane, under the Manual Tools (all) section, scroll down and click the *nix RPC
Info option, as shown in the screenshot.

If a dialog box appears explaining the tool, click OK.

27. In the Target Hostname or IPv4 Address field enter [Link] and click Dump Portmap.
28. The result appears displaying the RPC info of the target machine (Windows Server 2019), as
shown in the screenshot.
 Enumerating RPC endpoints enables attackers to identify any vulnerable services on
these service ports. In networks protected by firewalls and other security
establishments, this portmapper is often filtered. Therefore, attackers scan wide port
ranges to identify RPC services that are open to direct attack.

29. This concludes the demonstration of performing SMB and RPC enumeration on the target
systems using NetScanTools Pro.
30. Close all open windows and document all the acquired information.

Task 2: Perform RPC, SMB, and FTP Enumeration using

Nmap
Nmap is a utility used for network discovery, network administration, and security auditing. It is also
used to perform tasks such as network inventory, service upgrade schedule management, and host or
service uptime monitoring.

Here, we will use Nmap to carry out RPC, SMB, and FTP enumeration.

Before starting this lab, we must configure the FTP service in the target machine (Windows Server
2019). To do so, follow Steps 1-10.
1. Click Windows Server 2019 to switch to the Windows Server 2019 machine.

If you are logged out of the Windows Server 2019 machine, click Ctrl+Alt+Delete,
then login into Administrator user profile using Pa$$w0rd as password.

2. Click on the File Explorer icon at the bottom of Desktop. In the File Explorer window,
right-click on Local Disk (C:) and click New --> Folder.

3. A New Folder appears. Rename it to FTP-Site Data, as shown in the screenshot.

4. Close the window and click on the Type here to search icon at the bottom of the Desktop.
Type iis. In the search results, click on Internet Information Services Manager (IIS)
Manager, as shown in the screenshot.
5. In the Internet Information Services (IIS) Manager window, click to expand
SERVER2019 (SERVER2019\Administrator) in the left pane. Right-click Sites, and then
click Add FTP Site….
6. In the Add FTP Site window, type [Link] in the FTP site name field. In the Physical
path field, click on the icon. In the Browse For Folder window, click Local Disk (C:) and
FTP-Site Data, and then click OK.
7. In the Add FTP Site window, check the entered details and click Next.
8. The Binding and SSL Settings wizard appears. Under the Binding section, in the IP
Address field, click the drop-down icon and select [Link]. Under the SSL section, select
the No SSL radio button and click Next.
9. The Authentication and Authorization Information wizard appears. In the Allow access to
section, select All users from the drop-down list. In the Permissions section, select both the
Read and Write options and click Finish.
10. The Internet Information Services (IIS) Manager window appears with a newly added FTP
site ([Link]) in the left pane. Click the Site node in the left pane and note that the Status
is Started (ftp), as shown in the screenshot.
11. Close all windows.
12. Click Parrot Security to switch to the Parrot Security machine.
13. Click the MATE Terminal icon at the top of the Desktop to open a Terminal window.
14. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
15. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

16. Now, type cd and press Enter to jump to the root directory.
17. In the Parrot Terminal window, type nmap -p 21 [Target IP Address] (in this case,
[Link]) and press Enter.
18. The scan result appears, indicating that port 21 is open and the FTP service is running on it, as
shown in the screenshot.
19. In the terminal window, type nmap -T4 -A [Target IP Address] (here, the target IP address
is [Link]) and press Enter.

In this command, -T4: specifies the timing template (the number can be 0-5) and -A:
specifies aggressive scan. The aggressive scan option supports OS detection (-O),
version scanning (-sV), script scanning (-sC), and traceroute (--traceroute).
20. The scan result appears, displaying information regarding open ports, services along with
their versions. You can observe the RPC service and NFS service running on the ports 111
and 2049, respectively, as shown in the screenshot.
21. Click the MATE Terminal icon at the top of the Desktop to open a new Terminal window.
22. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
23. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

24. Now, type cd and press Enter to jump to the root directory.
25. In the terminal window, type nmap -p [Target Port] -A [Target IP Address] (in this
example, the target port is 445 and the target IP address is [Link]) and press Enter.

In this command, -p: specifies the port to be scanned, and -A: specifies aggressive
scan. The aggressive scan option supports OS detection (-O), version scanning (-sV),
script scanning (-sC), and traceroute (--traceroute).

26. The scan result appears, displaying that port 445 is open, and giving detailed information
under the Host script results section about the running SMB, as shown in the screenshot.
27. In the terminal window, type nmap -p [Target Port] -A [Target IP Address] (in this
example, the target port is 21 and target IP address is [Link]) and press Enter.

In this command, -p specifies the port to be scanned and -A specifies aggressive scan.
The aggressive scan option supports OS detection (-O), version scanning (-sV), script
scanning (-sC), and traceroute (--traceroute).

28. The scan result appears, displaying that port 21 is open, and giving traceroute information, as
shown in the screenshot.
 29. Using this information, attacker can further identify any vulnerable service running on the
open service ports and exploit them to launch attacks.
30. This concludes the demonstration of performing RPC, SMB, and FTP enumeration using
Nmap.
31. Close all open windows and document all the acquired information.

Enumeration
2 Hr 20 Min Remaining

Lab 8: Perform Enumeration using Various

Enumeration Tools
Lab Scenario

The details obtained in the previous steps might not reveal all potential vulnerabilities in the target
network. There may be more information available that could help attackers to identify loopholes to
exploit. As an ethical hacker, you should use a range of tools to find as much information as possible
about the target network’s systems. This lab activity will demonstrate further enumeration tools for
extracting even more information about the target system.

Lab Objectives
  Enumerate information using Global Network Inventory
 Enumerate network resources using Advanced IP Scanner
 Enumerate information from Windows and Samba hosts using Enum4linux

Overview of Enumeration Tools

To recap what you have learned so far, enumeration tools are used to collect detailed information
about target systems in order to exploit them. The information collected by these enumeration tools
includes data on the NetBIOS service, usernames and domain names, shared folders, the network
(such as ARP tables, routing tables,traffic, etc.), user accounts, directory services, etc.

Task 1: Enumerate Information using Global Network

Inventory
Global Network Inventory is used as an audit scanner in zero deployment and agent-free
environments. It scans single or multiple computers by IP range or domain, as defined by the Global
Network Inventory host file.

Here, we will use the Global Network Inventory to enumerate various types of data from a target IP
address range or single IP.

1. Click Windows 11 to switch to the Windows 11 machine, Click Search icon ( ) on

the Desktop. Type gni in the search field, the Global Network Inventory appears in the
results, click Open to launch it.
 If a User Account Control pop-up appears, click Yes.

2. The About Global Network Inventory wizard appears; click I Agree.

3. The Global Network Inventory GUI appears. Click Close on the Tip of the Day pop-up.
4. The New Audit Wizard window appears; click Next.
5. Under the Audit Scan Mode section, click the Single address scan radio button, and then
click Next.

You can also scan an IP range by clicking on the IP range scan radio button, after
which you will specify the target IP range.
6. Under the Single Address Scan section, specify the target IP address in the Name field of the
Single address option (in this example, the target IP address is [Link]); Click Next.
7. The next section is Authentication Settings; select the Connect as radio button and enter the
Windows Server 2022 machine credentials (Domain\Username: Administrator and
Password: Pa$$w0rd), and then click Next.

In reality, attackers do not know the credentials of the remote machine(s). In this
situation, they choose the Connect as currently logged on user option and perform a
scan to determine which machines are active in the network. With this option, they
will not be able to extract all the information about the target system. Because this lab
is just for assessment purposes, we have entered the credentials of the remote
machine directly.
8. In the final step of the wizard, leave the default settings unchanged and click Finish.
9. The Scan progress window will appear.
10. The results are displayed when the scan finished. The Scan summary of the scanned target IP
address ([Link]) appears.

The scan result might vary when you perform this task.
11. Hover your mouse cursor over the Computer details under the Scan summary tab to view the
scan summary, as shown in the screenshot.
12. Click the Operating System tab and hover the mouse cursor over Windows details to view
the complete details of the machine.
13. Click the BIOS tab, and hover the mouse cursor over windows details to display detailed
BIOS settings information.
14. Click the NetBIOS tab, and hover the mouse cursor over any NetBIOS application to display
the detailed NetBIOS information about the target.

Hover the mouse cursor over each NetBIOS application to view its details.
15. Click the User groups tab and hover the mouse cursor over any username to display detailed
user groups information.

Hover the mouse cursor over each username to view its details.
16. Click the Users tab, and hover the mouse cursor over the username to view login details for
the target machine.
17. Click the Services tab and hover the mouse cursor over any service to view its details.
18. Click the Installed software tab, and hover the mouse cursor over any software to view its
details.
19. Click the Shares tab, and hover the mouse cursor over any shared folder to view its details.
 20. Similarly, you can click other tabs such as Computer System, Processors, Main board,
Memory, SNMP systems and Hot fixes. Hover the mouse cursor over elements under each
tab to view their detailed information.
21. This concludes the demonstration of performing enumeration using the Global Network
Inventory.
22. Close all open windows and document all the acquired information.

Task 2: Enumerate Network Resources using Advanced

IP Scanner
Advanced IP Scanner provides various types of information about the computers on a target network.
The program shows all network devices, gives you access to shared folders, provides remote control
of computers (via RDP and Radmin), and can even remotely switch computers off.

Here, we will use the Advanced IP Scanner to enumerate the network resources of the target network.

1. Click Windows Server 2019 to switch to the Windows Server 2019 machine.

If you are logged out of the Windows Server 2019 machine, click Ctrl+Alt+Delete,
then login into Administrator user profile using Pa$$w0rd as password.
2. Click Search icon ( ) on the Desktop. Type advanced ip in the search field, the
Advanced IP Scanner appears in the results, click Advanced IP Scanner to launch it.

3. The Advanced IP Scanner GUI appears, as shown in the screenshot.

If a Check for updates pop-up appears, click Later.

4. In the IP address range field, specify the IP range (in this example, we will target [Link]-
[Link]). Click the Scan button.
5. Advanced IP Scanner scans the target IP address range, with progress tracked by the status
bar at the bottom of the window. Wait for the scan to complete.
6. The scan results appear, displaying information about active hosts in the target network such
as status, machine name, IP address, manufacturer name, and MAC addresses, as shown in
the screenshot.
7. Click the Expand all icon to view the shared folders and services running on the target
network.
8. The shared folders and services running on the target network appear, as shown in the
screenshot.
9. Right-click any of the detected IP addresses to list available options. Expand Tools options.
 10. Using these options, you can ping, traceroute, transfer files, chat, send a message, connect to
the target machine remotely (using Radmin), etc.

To use the Radmin option, you need to install Radmin Viewer, which you can
download at [Link]

11. In the same way, you can select various other options to retrieve shared files, view system-
related information, etc.
12. This concludes the demonstration of enumerating network resources using Advanced IP
Scanner.
13. Close all open windows and document all the acquired information.

Task 3: Enumerate Information from Windows and

Samba Hosts using Enum4linux
Enum4linux is a tool for enumerating information from Windows and Samba systems. It is used for
share enumeration, password policy retrieval, identification of remote OSes, detecting if hosts are in a
workgroup or a domain, user listing on hosts, listing group membership information, etc.

Here, we will use the Enum4Linux to perform enumeration on a Windows and a Samba host.
1. Click Parrot Security to switch to the Parrot Security machine.
2. Click the MATE Terminal icon at the top of the Desktop to open a Terminal window.

3. A Parrot Terminal window appears. In the terminal window, type sudo su and press Enter
to run the programs as a root user.
4. In the [sudo] password for attacker field, type toor as a password and press Enter.

The password that you type will not be visible.

5. Now, type cd and press Enter to jump to the root directory.

6. In the Parrot Terminal window, type enum4linux -h and press Enter to view the various
options available with enum4linux.
7. The help options appear, as shown in the screenshot. In this lab, we will demonstrate only a
few options to conduct enumeration on the target machine.
8. We will first enumerate the NetBIOS information of the target machine. In the terminal
window, type enum4linux -u martin -p apple -n [Target IP Address] (in this case,
[Link]) and hit Enter.

In this command, -u user: specifies the username to use and -p pass: specifies the
password.
9. The tool enumerates the target system and displays the NetBIOS information under the
Nbtstat Information section, as shown in the screenshot.
10. In the terminal window, type enum4linux -u martin -p apple -U [Target IP Address] (here,
[Link]) and hit Enter to run the tool with the “get userlist” option.

In this command, -u user specifies the username to use, -p pass specifies the
password and -U retrieves the userlist.

In this case, [Link] is the IP address of the Windows Server 2022.

11. Enum4linux starts enumerating and displays data such as Target Information,
Workgroup/Domain, domain SID (security identifier), and the list of users, along with their
respective RIDs (relative identifier), as shown in the screenshots below.
12. Second, we will obtain the OS information of the target; type enum4linux -u martin -p
apple -o [Target IP Address] (in this case, [Link]) and hit Enter.

In this command, -u user specifies the username to use, -p pass specifies the
password and -o retrieves the OS information.
13. The tool enumerates the target system and lists its OS details, as shown in the screenshot.
14. Third, we will enumerate the password policy information of our target machine. In the
terminal window, type enum4linux -u martin -p apple -P [Target IP Address] (in this case,
[Link]) and hit Enter.

In this command, -u user specifies the username to use, -p pass specifies the
password and -P retrieves the password policy information.
15. The tool enumerates the target system and displays its password policy information, as shown
in the screenshot.
16. Fourth, we will enumerate the target machine’s group policy information. In the terminal
window, type enum4linux -u martin -p apple -G [Target IP Address] (in this case,
[Link]) and hit Enter.

In this command, -u user specifies the username to use, -p pass specifies the
password and -G retrieves group and member list.
17. The tool enumerates the target system and displays the group policy information, as shown in
the screenshot.
18. It further enumerates the built-in group memberships, local group memberships, etc.
displaying them as shown in the screenshot.
19. Finally, we will enumerate the share policy information of our target machine. Type
enum4linux -u martin -p apple -S [Target IP Address] (in this case, [Link]) and hit
Enter.

In this command, -u user specifies the username to use, -p pass specifies the
password and -S retrieves sharelist.
20. The result appears, displaying the enumerate shared folders on the target system.
 21. Using this information, attackers can gain unauthorized access to the user accounts and
groups, and view confidential information in the shared drives.
22. This concludes the demonstration of performing enumeration using Enum4linux.
23. Close all open windows and document all the acquired information.

Check this box to confirm completion of this module.