In this video, we are going to learn an important topic, which is exploitation.
SMB server message.
Block protocol is a client server communication protocol used for sharing access to files, printers,
serial ports and other resources on the network.
To scan for SMB, we can use Nmap.
Lesson by default runs on port one, three, nine and port four, four five.
If SMB service is running, we can use a tool called ENUM for Linux that is used to enumerate SMB shares
in both Windows and Linux systems.
It is basically a wrapper around the tools in the samba package and makes it very easy to quickly extract
information from the target pertaining to SMB.
It is installed by default on Parrot and Kali Linux.
Nmap also has a script that can be used to enumerate SMB, which is SMB OS Discovery module.
You can use the command sudo and specify the script with script flag and use the script os discovery
dot NSC.
To gain access to the target machine, we can use SMB client.
You can list all shares with Dash L flag.
And you can specify a shade to access it.
Now let's see the demonstration.
So I will be using network services room from Tryhackme.
And for this demonstration I will be using Kali Linux provided by Tryhackme in the browser.
To start your Kali Linux.
And let's just scroll down to SMB task.
Try Hack Me first, explains SMB and provides very useful information about the basic functioning of
the protocol.
So the first question is what does SMB stand for?
Which is server message block.
The second question is what type of protocol is SMB?
It is a response request protocol.
The third question is how do clients connect to servers, which is TCP IP protocol?
And the last question is what does Samba run on?
Samba is a native Unix client.
Now let's move on to the next task, which is about enumerating SMB.
Now start your machine.
So the first question is conduct an Nmap scan.
So I want my Kali Linux.
Open a new terminal.
Lodge and Nmap scan.
Dash is for style scan.
For is to speed up the process.
And the script world will check for default vulnerabilities on the target system.
And we do have service running on Port one, three nine and Port 145.
So back on.
Try hack me.
So there are three ports open on the target machine.
And SMB is running on port one, three nine and port 445.
Now let's launch enum for Linux.
Open a new terminal.
Use the command init for Linux Dash A is to get all information about the target and specify the IP
address.
An enum for Linux will start up.
It will start gathering information about the target machine, including the workgroup name, the user
names and the exposed shares.
To the next question on Try hack Me.
Is about the workgroup name, which is workgroup.
The next question is about the machine name.
You can use the output from Einar for Linux, but let's just use the Nmap script to launch a new Nmap
scan and specify SMB OS discovery script.
And we get the machine name, which is Polo SMB.
The next question is what operating system version is running, which is 6.1.
The next question asks for the interesting share.
We have a profile share name, which may be interesting.
Now let's move on to the next task and try to exploit it.
The first question about exploitation is the command syntax, which is SMB client, the IP address and
the share name.
Now let's just connect to this profile, share and see what's in there.
Open a terminal.
Do the command SMB client.
Specify the IP address and the share name.
And we are connected.
Use the command to list down all the contents of the folder.
So this year allows the anonymous access and does not ask for the password.
For as per the try hack me hint we have to look for interesting files.
So we have a file name working from home.
To sketch out its content.
The cat command is not working.
Does the command more?
And we have a note to John Cactus from James.
Answer the question to me.
So this folder may belong to John Cactus.
The note also says that service has been configured.
So the second interesting directory in the folder is ssh.
So browse to it.
And we do have a private key in it called ID underscore RSA.
You can download the key with get command.
Now let's connect to the machine with SSH.
To make the key work, you have to first of all, change the mode.
Use the command chain mode 600 and specify the file name.
You can also check the contents of the file with cat command.
No connect to the target machine with ssh.
Use the command ssh dash i.
Specify the key name the username cactus and the IP address.
And we are connected to the target machine.
So there is a small text file in the current directory.
Get out the contents with cat command.
And we do have our flag.
Just copy the flag and paste it on Tryhackme.
So we have completed exploitation on network service.
Roam on Tryhackme.
I hope you like this lecture and see you in the next lecture.