WEBVTT 00:00.550 --> 00:07.390 Well, I have to admit, this is what I would call a super fun video because we are going to dive into 00:07.420 --> 00:09.910 some sample enumeration techniques. 00:10.240 --> 00:18.340 In Windows there is a couple of tried and true naming conventions and naming mechanisms. 00:18.550 --> 00:21.270 One of those is net bios. 00:21.700 --> 00:25.360 The other is the existence of a hosts file, by the way. 00:25.660 --> 00:34.900 So on your Windows Drive is a host file and that can do a name resolution and override things like DNS. 00:35.230 --> 00:40.180 So watch out for that host file that's been around forever on a Windows system. 00:40.600 --> 00:42.090 But notice what I'm doing here. 00:42.100 --> 00:48.370 I am enumerating information about the local system with NBT step. 00:48.820 --> 00:55.210 So NBT stat, if you type that, you will get a list of all of the possible switches. 00:55.540 --> 00:59.740 Notice we can look at the bios name cache with dash. 00:59.740 --> 01:00.220 See. 01:00.520 --> 01:04.000 We can look at the list of local bios names with dilshan. 01:04.300 --> 01:07.750 So I'll do an NBT stat dash dn. 01:08.020 --> 01:13.900 And sure enough, we are enumerating the names for this local system. 01:14.170 --> 01:17.610 I can see that I'm in a workgroup called workgroup. 01:17.620 --> 01:22.870 That's the default Windows workgroup and I'm on a system name omen one. 01:23.590 --> 01:24.460 Boy, oh boy. 01:24.610 --> 01:32.410 You can tell that I am not in a high security type environment and that is because what a lazy name 01:32.410 --> 01:35.350 for my laptop, which is an HP omen. 01:35.830 --> 01:42.880 So niche we don't want to easily enumerate information like that to a would be attacker. 01:43.600 --> 01:47.380 So a classic case of don't do as I do here. 01:47.560 --> 01:47.980 Right. 01:48.010 --> 01:51.580 This machine I'm using is not one that I have well protected. 01:52.030 --> 01:52.420 All right. 01:52.420 --> 01:55.020 Anyways, so look at that. 01:55.030 --> 01:58.180 We just learned the name of this system, right? 01:58.720 --> 02:02.920 Now, what about shared resources that might be available? 02:03.100 --> 02:07.810 Well, we could enumerate that thanks to net view. 02:08.050 --> 02:13.900 So I can do the net view command and I do whack whack. 02:13.900 --> 02:17.350 The name of the machine that we've now learned is omen one. 02:17.350 --> 02:19.480 And then I do a forward slash all. 02:19.810 --> 02:21.040 And look at this. 02:21.340 --> 02:27.340 There is three shares that are being shared on my device. 02:27.520 --> 02:33.850 You might not have been aware of any of them, and that's because they are windows hidden shares. 02:33.850 --> 02:37.150 That's what that dollar sign at the S is an indicator of. 02:37.450 --> 02:39.780 And one is for remote admin. 02:39.790 --> 02:47.110 The other is the entire default share of the C drive and the remote IPC channel for remote calls. 02:47.470 --> 02:56.170 So notice we are able to enumerate even the hidden shares on this machine with that powerful net view 02:56.170 --> 02:56.710 command. 02:57.250 --> 03:05.320 Now something else in a microsoft environment that you might want to do is enumerate user accounts. 03:05.500 --> 03:06.850 What might that look like? 03:06.970 --> 03:07.900 Well, let me show you. 03:08.680 --> 03:16.810 Microsoft themselves gave us tools for enumeration of user account information in their called pass 03:16.840 --> 03:21.160 tools and noticed this list of tools. 03:21.910 --> 03:25.720 So we have exac to execute processes remotely. 03:25.960 --> 03:32.920 WPS file shows files opened remotely, displayed the SSID of a computer or a user. 03:32.920 --> 03:37.300 WPS get said notice once you remember that it's WPS tools. 03:37.630 --> 03:40.520 If they were to give you one of these tools. 03:40.540 --> 03:43.210 Notice how self-explanatory the names are. 03:43.240 --> 03:43.570 Right. 03:43.570 --> 03:46.930 So it would be very easy for you just to recall that. 03:46.930 --> 03:51.310 Yep, it's part of the tools toolkit and it's for enumeration. 03:51.850 --> 03:54.550 Now, notice this word CID right here. 03:54.790 --> 03:55.620 What is that? 03:55.630 --> 04:03.430 That is like second nature to me, because I'm an old, old, old Microsoft engineer from way back. 04:03.910 --> 04:04.300 Yes. 04:04.300 --> 04:09.800 I was supporting Windows Systems when it was oh my gosh, pre Windows 95. 04:10.180 --> 04:11.410 That's how old I am. 04:11.650 --> 04:18.640 So anyways, this sed concept is something we are intimately familiar with and that is the security 04:18.640 --> 04:21.190 ID of the computer or the user. 04:21.400 --> 04:24.210 It's a, you know, code. 04:24.220 --> 04:25.990 It's not the user's name. 04:26.170 --> 04:30.640 It's a unique identifier, a long string of digits. 04:30.940 --> 04:35.770 That is the true identity of the user on a system. 04:36.010 --> 04:41.980 So it is this ssid that must be protected at all costs, oftentimes in the Windows environment. 04:42.640 --> 04:49.630 By the way, the CID is why when you delete a user account, you can't just create another one with 04:49.630 --> 04:52.750 the same name and have it, you know, have all those properties. 04:53.350 --> 04:57.160 Things are identified by the CID in the Windows environment. 04:58.360 --> 05:06.880 So those are the exact kinds of tools that would be used when enumeration is being performed against 05:06.880 --> 05:14.860 a network infrastructure or some architectural solution you have in the cloud or whatever your I.T infrastructure 05:14.860 --> 05:15.430 might be. 05:15.970 --> 05:20.800 Those enumeration tools and steps that we went through, very, very typical.