SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports
and communications abstractions such as named pipes and mail slots between computers.
In addition to that, Sambor is freely available SMB server for Unix.
It's an implementation of SMB for Unix like systems.
SMB can run directly over TCP ports one three seven one three nine four four five were on UDP ports
one three seven and one three eight.
Now some versions of SMB protocol has known vulnerabilities, so you should enumerate the assembly services.
Now let's step back into the lab to use MSF modules for SMB.
All right, so you have made a scan over Métis voidable two and three to check to see if the SMB port
is open, type the service's command with a P parameter and SMB port numbers one three nine and four,
four or five.
And the ports are open on both machines.
MSF has a meaningful directory structure.
So you can find SMB related auxillary scanners under this directory.
You're not going to need to write every word, just hit the tab button to complete the commands.
Now, the basic logic behind the enumeration is service banner and version detection, so that means
I will first run the SMB version module show options.
And set our hosts to our target IP addresses.
And then you can run the module.
That module executed very quickly, but look at that, though, it does bring some really good information
about the target.
So as you can see, ten point ten to ten is a Windows Server 2008 R2 Standard Service back one, which
is Matus voidable three.
Now, on the other hand, Métis voidable, too, has Semba now why is the version detection important?
I hear you saying and scratching your head, well, let's have a look at this Sambor version.
This version of Sambor has a vulnerability.
Even Métis boy has an exploit for this, so I think you get the point.
But just one more point here.
Métis Point saves this information to improve your penetration test.
So let's type hosts as our command with PSY as a parameter.
Now you see Windows seven changed to Windows 2008.
So now let's go with another module, you can try all the others, but.
I'm going to choose SMB, M.S. one seven 10, show the options.
Set the host variable.
And run the module.
And it looks like Matus employable three is vulnerable to MS 17 through 10.
So let's let's Google this vulnerability, shall we?
There are many topics about this vulnerability, and that is boy has an exploit module for that particular
vulnerability.
So that's a good way, I think, to illustrate how enumeration gives you better results.
So make a note of this vulnerability.
You're going to need it later.
OK, so let's go back to the MSF council.
All right, so this is the last one.
This is the SMB login module.
I will immediately set our host.
Now, I'll need a dictionary file to brute force.
So in a new tab.
I will create one.
For this, you can use the cool tool.
It's really simple and very handy.
The.
For how deep her crawl target, Paige and M for minimum character numbers for words in the dictionary.
And then the name of the output file.
So here, I'm going to use the address of the GitHub page of Metastable three is the target page that
Google will derive the words from.
So this process can take way too much time, but I'm going to stop it here because the dictionary file
has already been created.
So let's go back to the MSF console and use it.
I'll set the SMB user to vagrant.
So the pass fail to that dictionary file.
And then run the module.
So I'm going to interrupt the execution.
Did you see at the beginning of the output, did you notice the the green color?
That's because you need to enter the pair, vagrant, vagrant.
OK, so that's what we need.
So make a note of that.
Now, SMB reveal is the valuable information that you get.