Difference between revisions of "Episode297"

From Security Weekly Wiki
Jump to navigationJump to search
Line 17: Line 17:
  
  
 +
= Tech Segment =
 +
Recenntly I have been working more and more on my pentest plugin for Metasploit doing bug fixes and trying to improve some of the current areas of it. I added the Auto Exploit plugin to it for exploit automation and added some commands to aid in doing enumeration and discovery thru a pivot.
 +
 +
I was talking with the guys in Defensive Intuition and Black Hills Defensive Security and one of the areas they wanted to see me cover in the plugin was being able to quickly move enumerating and scanning other targets when they got a Meterpreter session on a clients network. So I added 2 commands to help with this to the plugin.
 +
 +
Lets start with a session that is connected to a host that is behind NAT:
 +
<pre>
 +
msf > sessions
 +
 +
Active sessions
 +
===============
 +
 +
  Id  Type                  Information                            Connection
 +
  --  ----                  -----------                            ----------
 +
  1  meterpreter x86/win32  VICTIMLAB\Administrator @ WIN2K3LAB01  192.168.1.100:4444 -> 192.168.1.138:49323 (10.10.10.2)
 +
 +
msf >
 +
 +
</pre>
 +
 +
lets start by loading the plugin
 +
<pre>
 +
msf >  load pentest
 +
 +
      ___        _          _    ___ _          _
 +
      | _ \___ _ _| |_ ___ __| |_  | _ \ |_  _ __ _(_)_ _
 +
      |  _/ -_) ' \  _/ -_|_-<  _| |  _/ | || / _` | | ' \
 +
      |_| \___|_||_\__\___/__/\__| |_| |_|\_,_\__, |_|_||_|
 +
                                              |___/
 +
 +
Version 1.2
 +
Pentest plugin loaded.
 +
by Carlos Perez (carlos_perez[at]darkoperator.com)
 +
[*] Successfully loaded plugin: pentest
 +
msf  exploit(handler) > back
 +
msf >
 +
 +
</pre>
 +
 +
As shown in my others post about the plugin it will add commands to the list of commands available in the console to look at the command available we can just enter the help command or ? :
 +
 +
<pre>
 +
msf > help
 +
. . . .
 +
Discovery Commands
 +
==================
 +
 +
    Command                Description
 +
    -------                -----------
 +
    discover_db            Run discovery modules against current hosts in the database.
 +
    network_discover        Performs a portscan and enumeration of services found for non pivot networks.
 +
    pivot_network_discover  Performs enumeration of networks available to a specified Meterpreter session.
 +
    show_session_networks  Enumerate the networks one could pivot thru Meterpreter in the active sessions.
 +
. . . .
 +
</pre>
 +
The commands we have available are:
 +
* discover_db - this command will go thru the hosts that are present in the database and will run a set of modules to enumerate and gather information from the services that have been detected on those host. One can provide a range of host to limit the discovery and SMB settings for the SMB modules that will be ran against hosts.
 +
* network_discovery -  will run the nmap scanner against a given CIDR, it will determine the ports that are used by Metasploit auxiliary and exploit modules and use those if none are specified and after running the scan it will run additional discovery modules to further enumerate and gather information from those services.
 +
* pivot_network_discover - This command will enumerate all interfaces and routes on a given Windows Meterpreter session, it will create routes to the found networks thru the session specified, it will determine which of the enumerated networks are directly connected to the host or are remote so as to determine the best way to run detection of hosts, it will do a ARP Sweep if the network is directly connected since this provides the most accuracy and if the network is a remote one it will execute a ping scan against it, it will execute if specified a TCP and UDP port scan against the hosts it discovered, if a port list is not provided it will auto generate one from the existing auxiliary and exploit modules currently available in addition to adding some additional common ones, if specified it will launch discovery modules to further enumerate the services found.
 +
* show_session_networks - will list the networks available thru Windows Meterpreter Sessions.
 +
 +
Lets start by listing the networks available thru a session. Lets first look at the options available for the show_session_networks command:
 +
 +
<pre>
 +
msf > show_session_networks -h
 +
This command will show the networks that can be routed thru a Meterpreter session.
 +
 +
OPTIONS:
 +
 +
    -h        Help Message.
 +
    -s <opt>  Sessions to enumerate networks against. Example <all> or <1,2,3,4>.
 +
 +
 +
</pre>
 +
 +
Now lets list the networks available:
 +
 +
<pre>
 +
msf > show_session_networks -s all
 +
Network    Netmask        Session
 +
-------    -------        -------
 +
10.10.10.0  255.255.255.0  1
 +
</pre>
 +
 +
Now that we know the networks connected to the session we can check the options we have available to the command pivot_network_discover :
 +
 +
<pre>
 +
msf > pivot_network_discover -h
 +
 +
OPTIONS:
 +
 +
    -D <opt>  SMB Domain for discovery(optional).
 +
    -P <opt>  SMB Password for discovery(optional).
 +
    -U <opt>  SMB Username for discovery(optional).
 +
    -d        Run Framework discovery modules against found hosts.
 +
    -h        Help Message.
 +
    -p <opt>  Port list. Provide a comma separated list of port and/or ranges to TCP scan.
 +
    -s <opt>  Session to do discovery of networks and hosts.
 +
    -t        Perform TCP port scan of hosts discovered.
 +
    -u        Perform UDP scan of hosts discovered.
 +
    -v        Be verbose and show pending actions.
 +
 +
 +
</pre>
 +
 +
Lets see what information we have in our current workspace for hosts, services and notes:
 +
 +
<pre>
 +
msf > hosts
 +
 +
Hosts
 +
=====
 +
 +
address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
 +
-------  ---  ----  -------  ---------  -----  -------  ----  --------
 +
 +
msf > services
 +
 +
Services
 +
========
 +
 +
host  port  proto  name  state  info
 +
----  ----  -----  ----  -----  ----
 +
 +
msf > notes
 +
msf >
 +
</pre>
 +
 +
Lets run a discovery thru the current session we have:
 +
 +
<pre>
 +
msf > pivot_network_discover -t -u -d -s 1
 +
[*] Identifying networks to discover
 +
[*] Routing new subnet 10.10.10.0/255.255.255.0 through session 1
 +
[*] Running windows/gather/arp_scanner against 1
 +
 +
[*] Running module against WIN2K3LAB01
 +
[*] ARP Scanning 10.10.10.0/24
 +
[*] IP: 10.10.10.2 MAC 00:0c:29:5e:e3:bd
 +
[*] IP: 10.10.10.1 MAC 00:0c:29:4d:e7:5a
 +
[*] IP: 10.10.10.200 MAC 00:0c:29:45:73:cb
 +
[*] IP: 10.10.10.201 MAC 00:0c:29:c9:15:98
 +
[*] IP: 10.10.10.239 MAC 00:0c:29:1e:8d:30
 +
[*] IP: 10.10.10.238 MAC 00:0c:29:10:5c:d7
 +
[*] IP: 10.10.10.243 MAC 00:0c:29:2e:97:ff
 +
[*] Generating list of ports used by Auxiliary Modules
 +
[*] Generating list of ports used by Exploit Modules
 +
[*] Discovering 10.10.10.0/24 Network
 +
[+] Running TCP Portscan against 10.10.10.2
 +
[+] Running TCP Portscan against 10.10.10.1
 +
[+] Running TCP Portscan against 10.10.10.200
 +
[+] Running TCP Portscan against 10.10.10.201
 +
[+] Running TCP Portscan against 10.10.10.239
 +
[+] Running TCP Portscan against 10.10.10.238
 +
[+] Running TCP Portscan against 10.10.10.243
 +
[+] Running UDP Portscan against 10.10.10.2
 +
[+] Running UDP Portscan against 10.10.10.1
 +
[+] Running UDP Portscan against 10.10.10.200
 +
[*] 10.10.10.1:80 - TCP OPEN
 +
[*] 10.10.10.243:514 - TCP OPEN
 +
[*] 10.10.10.2:445 - TCP OPEN
 +
[*] 10.10.10.243:111 - TCP OPEN
 +
[*] 10.10.10.243:445 - TCP OPEN
 +
[*] 10.10.10.239:23 - TCP OPEN
 +
[*] 10.10.10.243:23 - TCP OPEN
 +
[*] 10.10.10.243:21 - TCP OPEN
 +
[*] 10.10.10.2:135 - TCP OPEN
 +
[*] 10.10.10.243:1099 - TCP OPEN
 +
[*] 10.10.10.243:80 - TCP OPEN
 +
[*] 10.10.10.243:22 - TCP OPEN
 +
[*] 10.10.10.243:513 - TCP OPEN
 +
[*] 10.10.10.2:389 - TCP OPEN
 +
[*] 10.10.10.239:135 - TCP OPEN
 +
[*] 10.10.10.243:25 - TCP OPEN
 +
[*] 10.10.10.201:135 - TCP OPEN
 +
[*] 10.10.10.200:445 - TCP OPEN
 +
[*] 10.10.10.200:135 - TCP OPEN
 +
[*] 10.10.10.243:512 - TCP OPEN
 +
[*] 10.10.10.239:445 - TCP OPEN
 +
[*] 10.10.10.238:445 - TCP OPEN
 +
[*] 10.10.10.238:135 - TCP OPEN
 +
[*] Discovered NTP on 10.10.10.2:123 (1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e)
 +
[*] Discovered DNS on 10.10.10.1:53 (403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435)
 +
[*] Discovered NetBIOS on 10.10.10.200:137 (WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb)
 +
 +
. . . .
 +
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243:23 TELNET _                  _      _ _        _    _      ____  \x0a _ __ ___  ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[-] File doesn't seem to exist. The upload probably failed.
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled.
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] waiting for some modules to finish
 +
msf >
 +
[*] 10.10.10.243:3306 is running MySQL 5.0.51a-3ubuntu5 (protocol 10)
 +
[*] 10.10.10.243:5900, VNC server protocol version : 3.3
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243:5900, VNC server security types supported : VNC
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243:5432 Postgres - Version 8.3.8 (Pre-Auth)
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.239:23 Does not support encryption: Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
[*] 10.10.10.243:23 Does not support encryption: _                  _      _ _        _    _      ____  \x0a _ __ ___  ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
 +
[*] Scanned 1 of 1 hosts (100% complete)
 +
 +
msf >
 +
</pre>
 +
 +
One thing that we have to keep in mind scanning thru a pivot is slow, that is why I decided to go with the list of generated ports since these will provide me the best chances to leverage the tools and modules in the framework. For large networks I recommend also using the -v option to see how many scanner jobs are pending.
 +
 +
Now that we finished the discovery lets look at the hosts, services and notes we now have:
 +
 +
<pre>
 +
msf > hosts
 +
 +
Hosts
 +
=====
 +
 +
address      mac                name            os_name            os_flavor        os_sp  purpose  info  comments
 +
-------      ---                ----            -------            ---------        -----  -------  ----  --------
 +
10.10.10.1    00:0c:29:4d:e7:5a  10.10.10.1      Unknown                                    device       
 +
10.10.10.2    00:0c:29:5e:e3:bd  win2k3lab01      Microsoft Windows  2003            SP2    server       
 +
10.10.10.200  00:0c:29:45:73:cb  winxplab01      Microsoft Windows  XP              SP2    client       
 +
10.10.10.201  00:0c:29:c9:15:98                  Unknown                                    device       
 +
10.10.10.238  00:0c:29:10:5c:d7  win-yr4v852v71y  Microsoft Windows  2008 Enterprise  SP1    server       
 +
10.10.10.239  00:0c:29:1e:8d:30  test-01bcdaf47c  Microsoft Windows  XP              SP2    client       
 +
10.10.10.243  00:0c:29:2e:97:ff  metasploitable  Linux              Debian                  server       
 +
 +
msf > services
 +
 +
Services
 +
========
 +
 +
host          port  proto  name      state  info
 +
----          ----  -----  ----      -----  ----
 +
10.10.10.1    53    udp    dns      open  403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435
 +
10.10.10.1    80    tcp    http      open  lighttpd/1.4.23
 +
10.10.10.2    135    tcp              open 
 +
10.10.10.2    123    udp    ntp      open  1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e
 +
10.10.10.2    53    udp    dns      open  Microsoft DNS
 +
10.10.10.2    137    udp    netbios  open  WIN2K3LAB01:<00>:U :VICTIMLAB:<00>:G :VICTIMLAB:<1c>:G :WIN2K3LAB01:<20>:U :VICTIMLAB:<1b>:U :VICTIMLAB:<1e>:G :VICTIMLAB:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:5e:e3:bd
 +
10.10.10.2    3389  tcp              open 
 +
10.10.10.2    445    tcp    smb      open  Windows 2003 Service Pack 2 (language: Unknown) (name:WIN2K3LAB01) (domain:VICTIMLAB)
 +
10.10.10.2    389    tcp              open 
 +
10.10.10.200  123    udp    ntp      open  1c020efa00000000001000000a0a0a02d3b17b6e0454d46dc54f234b71b152f3d3b1e2508240cefdd3b1e2508240cefd
 +
10.10.10.200  135    tcp              open 
 +
10.10.10.200  3389  tcp              open 
 +
10.10.10.200  445    tcp    smb      open  Windows XP Service Pack 2 (language: English) (name:WINXPLAB01) (domain:VICTIMLAB)
 +
10.10.10.200  137    udp    netbios  open  WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb
 +
10.10.10.201  135    tcp              open 
 +
10.10.10.238  137    udp    netbios  open  WIN-YR4V852V71Y:<00>:U :WORKGROUP:<00>:G :WIN-YR4V852V71Y:<20>:U :00:0c:29:10:5c:d7
 +
10.10.10.238  135    tcp              open 
 +
10.10.10.238  445    tcp    smb      open  Windows 2008 Enterprise Service Pack 1 (language: Unknown) (name:WIN-YR4V852V71Y) (domain:WORKGROUP)
 +
10.10.10.239  23    tcp    telnet    open  Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
 +
10.10.10.239  123    udp    ntp      open  Microsoft NTP
 +
10.10.10.239  135    tcp              open 
 +
10.10.10.239  137    udp    netbios  open  TEST-01BCDAF47C:<00>:U :WORKGROUP:<00>:G :TEST-01BCDAF47C:<20>:U :WORKGROUP:<1e>:G :WORKGROUP:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:1e:8d:30
 +
10.10.10.239  445    tcp    smb      open  Windows XP Service Pack 2 (language: English) (name:TEST-01BCDAF47C) (domain:WORKGROUP)
 +
10.10.10.243  80    tcp    http      open  Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
 +
10.10.10.243  22    tcp    ssh      open  SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
 +
10.10.10.243  23    tcp    telnet    open  _                  _      _ _        _    _      ____  \x0a _ __ ___  ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
 +
10.10.10.243  25    tcp    smtp      open  220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
 +
 +
10.10.10.243  21    tcp    ftp      open  220 (vsFTPd 2.3.4)\x0d\x0a
 +
10.10.10.243  111    udp    portmap  open  100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(55600), 100024 v1 TCP(53257), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(58825), 100021 v3 UDP(58825), 100021 v4 UDP(58825), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(47361), 100021 v3 TCP(47361), 100021 v4 TCP(47361), 100005 v1 UDP(40587), 100005 v1 TCP(42089), 100005 v2 UDP(40587), 100005 v2 TCP(42089), 100005 v3 UDP(40587), 100005 v3 TCP(42089)
 +
10.10.10.243  111    tcp    sunrpc    open  100000 v2
 +
10.10.10.243  137    udp    netbios  open  METASPLOITABLE:<00>:U :METASPLOITABLE:<03>:U :METASPLOITABLE:<20>:U :WORKGROUP:<00>:G :WORKGROUP:<1e>:G :00:00:00:00:00:00
 +
10.10.10.243  139    tcp              open 
 +
10.10.10.243  445    tcp    smb      open  Unix Samba 3.0.20-Debian (language: Unknown) (domain:WORKGROUP)
 +
10.10.10.243  512    tcp              open 
 +
10.10.10.243  513    tcp              open 
 +
10.10.10.243  514    tcp              open 
 +
10.10.10.243  1099  tcp              open 
 +
10.10.10.243  1524  tcp              open 
 +
10.10.10.243  2049  udp    sunrpc    open  100003 v4
 +
10.10.10.243  2049  tcp    sunrpc    open  100003 v4
 +
10.10.10.243  3306  tcp    mysql    open  5.0.51a-3ubuntu5
 +
10.10.10.243  3632  tcp              open 
 +
10.10.10.243  5432  tcp    postgres  open  8.3.8
 +
10.10.10.243  5900  tcp    vnc      open  VNC protocol version 3.3
 +
10.10.10.243  6000  tcp              open 
 +
10.10.10.243  6667  tcp              open 
 +
10.10.10.243  6697  tcp              open 
 +
10.10.10.243  8180  tcp              open 
 +
10.10.10.243  8787  tcp              open 
 +
10.10.10.243  40587  udp    sunrpc    open  100005 v3
 +
10.10.10.243  42089  tcp    sunrpc    open  100005 v3
 +
10.10.10.243  47361  tcp    sunrpc    open  100021 v4
 +
10.10.10.243  53257  tcp    sunrpc    open  100024 v1
 +
10.10.10.243  55600  udp    sunrpc    open  100024 v1
 +
10.10.10.243  58825  udp    sunrpc    open  100021 v4
 +
 +
msf > notes
 +
[*] Time: 2012-07-19 01:35:46 UTC Note: host=10.10.10.2 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
 +
[*] Time: 2012-07-19 01:35:47 UTC Note: host=10.10.10.200 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
 +
[*] Time: 2012-07-19 01:36:03 UTC Note: host=10.10.10.239 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
 +
[*] Time: 2012-07-19 01:36:05 UTC Note: host=10.10.10.200 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
 +
[*] Time: 2012-07-19 01:36:16 UTC Note: host=10.10.10.238 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2008 Enterprise", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 1", :os_lang=>"Unknown"}
 +
[*] Time: 2012-07-19 01:36:22 UTC Note: host=10.10.10.239 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
 +
[*] Time: 2012-07-19 01:36:28 UTC Note: host=10.10.10.243 service=smb type=smb.fingerprint data={:os_flavor=>"Unix", :os_name=>"Unknown", :os_sp=>"Samba 3.0.20-Debian"}
 +
[*] Time: 2012-07-19 01:36:33 UTC Note: host=10.10.10.238 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
 +
[*] Time: 2012-07-19 01:36:34 UTC Note: host=10.10.10.243 service=139/tcp type=smb.domain.enumusers data={:sid_txt=>"5-21-1042354039-2475377354-766472396", :pass_min=>5, :pass_min_history=>0, :server_role=>3, :lockout_threshold=>0, :lockout_duration=>1480786430454, :lockout_window=>1480786430454, :users=>{1010=>"games", 501=>"nobody", 1210=>"bind", 1026=>"proxy", 1204=>"syslog", 3002=>"user", 1066=>"www-data", 1000=>"root", 1018=>"news", 1216=>"postgres", 1004=>"bin", 1016=>"mail", 1222=>"distccd", 1226=>"proftpd", 1202=>"dhcp", 1002=>"daemon", 1208=>"sshd", 1012=>"man", 1014=>"lp", 1218=>"mysql", 1082=>"gnats", 1200=>"libuuid", 1068=>"backup", 3000=>"msfadmin", 1224=>"telnetd", 1006=>"sys", 1206=>"klog", 1212=>"postfix", 3004=>"service", 1076=>"list", 1078=>"irc", 1214=>"ftp", 1220=>"tomcat55", 1008=>"sync", 1020=>"uucp"}, :name=>"METASPLOITABLE"}
 +
[*] Time: 2012-07-19 01:36:36 UTC Note: host=10.10.10.243 service=139/tcp type=smb.shares data={:shares=>[["print$", "DISK", "Printer Drivers"], ["tmp", "DISK", "oh noes!"], ["opt", "DISK", ""], ["IPC$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"], ["ADMIN$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"]]}
 +
[*] Time: 2012-07-19 01:35:33 UTC Note: host=10.10.10.2 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2003", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"Unknown"}
 +
 +
</pre>
 +
 +
I hope you find these new commands useful.
 
= Stories =  
 
= Stories =  
  

Revision as of 22:06, 2 August 2012


Announcements & Shameless Plugs

PaulDotCom Security Weekly - Episode 297 for Thursday July 31st, 2012

  • Episode 300 of PaulDotCom Security Weekly will be recorded and streamed live on Friday August 31st in support of of a cure for Breast Cancer. We will broadcast live from 10am until 6PM Eastern time and the show will feature tech segments, round table discussions and special guests. Mark it on your calendars today!
  • In other admin related news, we're leaving Ning and moving onwards. Ning was cool, but now its a haven for SPAM. I want to thank everyone for participating. In the meantime please follow us on Twitter (@pauldotcom), Facebook (https://www.facebook.com/therealpauldotcom), and add me on Google+ (Paul Asadoorian, I will have a good email account for that soon). Don't forget to join our mailing list http://mail.pauldotcom.com and look for a newsletter in the not-too-distant future.

Blackhat and DefCon news and wrap up

Teasers & Plugs


Tech Segment

Recenntly I have been working more and more on my pentest plugin for Metasploit doing bug fixes and trying to improve some of the current areas of it. I added the Auto Exploit plugin to it for exploit automation and added some commands to aid in doing enumeration and discovery thru a pivot.

I was talking with the guys in Defensive Intuition and Black Hills Defensive Security and one of the areas they wanted to see me cover in the plugin was being able to quickly move enumerating and scanning other targets when they got a Meterpreter session on a clients network. So I added 2 commands to help with this to the plugin.

Lets start with a session that is connected to a host that is behind NAT:

msf > sessions

Active sessions
===============

  Id  Type                   Information                            Connection
  --  ----                   -----------                            ----------
  1   meterpreter x86/win32  VICTIMLAB\Administrator @ WIN2K3LAB01  192.168.1.100:4444 -> 192.168.1.138:49323 (10.10.10.2)

msf > 

lets start by loading the plugin

msf >  load pentest

       ___         _          _     ___ _           _
      | _ \___ _ _| |_ ___ __| |_  | _ \ |_  _ __ _(_)_ _
      |  _/ -_) ' \  _/ -_|_-<  _| |  _/ | || / _` | | ' \ 
      |_| \___|_||_\__\___/__/\__| |_| |_|\_,_\__, |_|_||_|
                                              |___/
			
Version 1.2
Pentest plugin loaded.
by Carlos Perez (carlos_perez[at]darkoperator.com)
[*] Successfully loaded plugin: pentest
msf  exploit(handler) > back
msf > 

As shown in my others post about the plugin it will add commands to the list of commands available in the console to look at the command available we can just enter the help command or ? :

msf > help
. . . .
Discovery Commands
==================

    Command                 Description
    -------                 -----------
    discover_db             Run discovery modules against current hosts in the database.
    network_discover        Performs a portscan and enumeration of services found for non pivot networks.
    pivot_network_discover  Performs enumeration of networks available to a specified Meterpreter session.
    show_session_networks   Enumerate the networks one could pivot thru Meterpreter in the active sessions.
. . . .

The commands we have available are:

  • discover_db - this command will go thru the hosts that are present in the database and will run a set of modules to enumerate and gather information from the services that have been detected on those host. One can provide a range of host to limit the discovery and SMB settings for the SMB modules that will be ran against hosts.
  • network_discovery - will run the nmap scanner against a given CIDR, it will determine the ports that are used by Metasploit auxiliary and exploit modules and use those if none are specified and after running the scan it will run additional discovery modules to further enumerate and gather information from those services.
  • pivot_network_discover - This command will enumerate all interfaces and routes on a given Windows Meterpreter session, it will create routes to the found networks thru the session specified, it will determine which of the enumerated networks are directly connected to the host or are remote so as to determine the best way to run detection of hosts, it will do a ARP Sweep if the network is directly connected since this provides the most accuracy and if the network is a remote one it will execute a ping scan against it, it will execute if specified a TCP and UDP port scan against the hosts it discovered, if a port list is not provided it will auto generate one from the existing auxiliary and exploit modules currently available in addition to adding some additional common ones, if specified it will launch discovery modules to further enumerate the services found.
  • show_session_networks - will list the networks available thru Windows Meterpreter Sessions.

Lets start by listing the networks available thru a session. Lets first look at the options available for the show_session_networks command:

msf > show_session_networks -h
This command will show the networks that can be routed thru a Meterpreter session.

OPTIONS:

    -h        Help Message.
    -s <opt>  Sessions to enumerate networks against. Example <all> or <1,2,3,4>.


Now lets list the networks available:

msf > show_session_networks -s all
Network     Netmask        Session
-------     -------        -------
10.10.10.0  255.255.255.0  1

Now that we know the networks connected to the session we can check the options we have available to the command pivot_network_discover :

msf > pivot_network_discover -h

OPTIONS:

    -D <opt>  SMB Domain for discovery(optional).
    -P <opt>  SMB Password for discovery(optional).
    -U <opt>  SMB Username for discovery(optional).
    -d        Run Framework discovery modules against found hosts.
    -h        Help Message.
    -p <opt>  Port list. Provide a comma separated list of port and/or ranges to TCP scan.
    -s <opt>  Session to do discovery of networks and hosts.
    -t        Perform TCP port scan of hosts discovered.
    -u        Perform UDP scan of hosts discovered.
    -v        Be verbose and show pending actions.


Lets see what information we have in our current workspace for hosts, services and notes:

msf > hosts

Hosts
=====

address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------  ---  ----  -------  ---------  -----  -------  ----  --------

msf > services 

Services
========

host  port  proto  name  state  info
----  ----  -----  ----  -----  ----

msf > notes 
msf > 

Lets run a discovery thru the current session we have:

 msf > pivot_network_discover -t -u -d -s 1
[*] Identifying networks to discover
[*] Routing new subnet 10.10.10.0/255.255.255.0 through session 1
[*] Running windows/gather/arp_scanner against 1

[*] Running module against WIN2K3LAB01
[*] ARP Scanning 10.10.10.0/24
[*] 	IP: 10.10.10.2 MAC 00:0c:29:5e:e3:bd
[*] 	IP: 10.10.10.1 MAC 00:0c:29:4d:e7:5a
[*] 	IP: 10.10.10.200 MAC 00:0c:29:45:73:cb
[*] 	IP: 10.10.10.201 MAC 00:0c:29:c9:15:98
[*] 	IP: 10.10.10.239 MAC 00:0c:29:1e:8d:30
[*] 	IP: 10.10.10.238 MAC 00:0c:29:10:5c:d7
[*] 	IP: 10.10.10.243 MAC 00:0c:29:2e:97:ff
[*] Generating list of ports used by Auxiliary Modules
[*] Generating list of ports used by Exploit Modules
[*] Discovering 10.10.10.0/24 Network
[+] Running TCP Portscan against 10.10.10.2
[+] Running TCP Portscan against 10.10.10.1
[+] Running TCP Portscan against 10.10.10.200
[+] Running TCP Portscan against 10.10.10.201
[+] Running TCP Portscan against 10.10.10.239
[+] Running TCP Portscan against 10.10.10.238
[+] Running TCP Portscan against 10.10.10.243
[+] Running UDP Portscan against 10.10.10.2
[+] Running UDP Portscan against 10.10.10.1
[+] Running UDP Portscan against 10.10.10.200
[*] 10.10.10.1:80 - TCP OPEN
[*] 10.10.10.243:514 - TCP OPEN
[*] 10.10.10.2:445 - TCP OPEN
[*] 10.10.10.243:111 - TCP OPEN
[*] 10.10.10.243:445 - TCP OPEN
[*] 10.10.10.239:23 - TCP OPEN
[*] 10.10.10.243:23 - TCP OPEN
[*] 10.10.10.243:21 - TCP OPEN
[*] 10.10.10.2:135 - TCP OPEN
[*] 10.10.10.243:1099 - TCP OPEN
[*] 10.10.10.243:80 - TCP OPEN
[*] 10.10.10.243:22 - TCP OPEN
[*] 10.10.10.243:513 - TCP OPEN
[*] 10.10.10.2:389 - TCP OPEN
[*] 10.10.10.239:135 - TCP OPEN
[*] 10.10.10.243:25 - TCP OPEN
[*] 10.10.10.201:135 - TCP OPEN
[*] 10.10.10.200:445 - TCP OPEN
[*] 10.10.10.200:135 - TCP OPEN
[*] 10.10.10.243:512 - TCP OPEN
[*] 10.10.10.239:445 - TCP OPEN
[*] 10.10.10.238:445 - TCP OPEN
[*] 10.10.10.238:135 - TCP OPEN
[*] Discovered NTP on 10.10.10.2:123 (1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e)
[*] Discovered DNS on 10.10.10.1:53 (403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435)
[*] Discovered NetBIOS on 10.10.10.200:137 (WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb)

. . . . 

[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 TELNET _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
[*] Scanned 1 of 1 hosts (100% complete)
[-] File doesn't seem to exist. The upload probably failed.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] waiting for some modules to finish
msf > 
[*] 10.10.10.243:3306 is running MySQL 5.0.51a-3ubuntu5 (protocol 10)
[*] 10.10.10.243:5900, VNC server protocol version : 3.3
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5900, VNC server security types supported : VNC
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5432 Postgres - Version 8.3.8 (Pre-Auth)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.239:23 Does not support encryption: Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin: 
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 Does not support encryption: _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login: 
[*] Scanned 1 of 1 hosts (100% complete)

msf >

One thing that we have to keep in mind scanning thru a pivot is slow, that is why I decided to go with the list of generated ports since these will provide me the best chances to leverage the tools and modules in the framework. For large networks I recommend also using the -v option to see how many scanner jobs are pending.

Now that we finished the discovery lets look at the hosts, services and notes we now have:

msf > hosts 

Hosts
=====

address       mac                name             os_name            os_flavor        os_sp  purpose  info  comments
-------       ---                ----             -------            ---------        -----  -------  ----  --------
10.10.10.1    00:0c:29:4d:e7:5a  10.10.10.1       Unknown                                    device         
10.10.10.2    00:0c:29:5e:e3:bd  win2k3lab01      Microsoft Windows  2003             SP2    server         
10.10.10.200  00:0c:29:45:73:cb  winxplab01       Microsoft Windows  XP               SP2    client         
10.10.10.201  00:0c:29:c9:15:98                   Unknown                                    device         
10.10.10.238  00:0c:29:10:5c:d7  win-yr4v852v71y  Microsoft Windows  2008 Enterprise  SP1    server         
10.10.10.239  00:0c:29:1e:8d:30  test-01bcdaf47c  Microsoft Windows  XP               SP2    client         
10.10.10.243  00:0c:29:2e:97:ff  metasploitable   Linux              Debian                  server         

msf > services 

Services
========

host          port   proto  name      state  info
----          ----   -----  ----      -----  ----
10.10.10.1    53     udp    dns       open   403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435
10.10.10.1    80     tcp    http      open   lighttpd/1.4.23
10.10.10.2    135    tcp              open   
10.10.10.2    123    udp    ntp       open   1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e
10.10.10.2    53     udp    dns       open   Microsoft DNS
10.10.10.2    137    udp    netbios   open   WIN2K3LAB01:<00>:U :VICTIMLAB:<00>:G :VICTIMLAB:<1c>:G :WIN2K3LAB01:<20>:U :VICTIMLAB:<1b>:U :VICTIMLAB:<1e>:G :VICTIMLAB:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:5e:e3:bd
10.10.10.2    3389   tcp              open   
10.10.10.2    445    tcp    smb       open   Windows 2003 Service Pack 2 (language: Unknown) (name:WIN2K3LAB01) (domain:VICTIMLAB)
10.10.10.2    389    tcp              open   
10.10.10.200  123    udp    ntp       open   1c020efa00000000001000000a0a0a02d3b17b6e0454d46dc54f234b71b152f3d3b1e2508240cefdd3b1e2508240cefd
10.10.10.200  135    tcp              open   
10.10.10.200  3389   tcp              open   
10.10.10.200  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:WINXPLAB01) (domain:VICTIMLAB)
10.10.10.200  137    udp    netbios   open   WINXPLAB01:<00>:U :VICTIMLAB:<00>:G :WINXPLAB01:<20>:U :VICTIMLAB:<1e>:G :00:0c:29:45:73:cb
10.10.10.201  135    tcp              open   
10.10.10.238  137    udp    netbios   open   WIN-YR4V852V71Y:<00>:U :WORKGROUP:<00>:G :WIN-YR4V852V71Y:<20>:U :00:0c:29:10:5c:d7
10.10.10.238  135    tcp              open   
10.10.10.238  445    tcp    smb       open   Windows 2008 Enterprise Service Pack 1 (language: Unknown) (name:WIN-YR4V852V71Y) (domain:WORKGROUP)
10.10.10.239  23     tcp    telnet    open   Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
10.10.10.239  123    udp    ntp       open   Microsoft NTP
10.10.10.239  135    tcp              open   
10.10.10.239  137    udp    netbios   open   TEST-01BCDAF47C:<00>:U :WORKGROUP:<00>:G :TEST-01BCDAF47C:<20>:U :WORKGROUP:<1e>:G :WORKGROUP:<1d>:U :__MSBROWSE__:<01>:G :00:0c:29:1e:8d:30
10.10.10.239  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:TEST-01BCDAF47C) (domain:WORKGROUP)
10.10.10.243  80     tcp    http      open   Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
10.10.10.243  22     tcp    ssh       open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
10.10.10.243  23     tcp    telnet    open   _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
10.10.10.243  25     tcp    smtp      open   220 metasploitable.localdomain ESMTP Postfix (Ubuntu)

10.10.10.243  21     tcp    ftp       open   220 (vsFTPd 2.3.4)\x0d\x0a
10.10.10.243  111    udp    portmap   open   100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(55600), 100024 v1 TCP(53257), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(58825), 100021 v3 UDP(58825), 100021 v4 UDP(58825), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(47361), 100021 v3 TCP(47361), 100021 v4 TCP(47361), 100005 v1 UDP(40587), 100005 v1 TCP(42089), 100005 v2 UDP(40587), 100005 v2 TCP(42089), 100005 v3 UDP(40587), 100005 v3 TCP(42089)
10.10.10.243  111    tcp    sunrpc    open   100000 v2
10.10.10.243  137    udp    netbios   open   METASPLOITABLE:<00>:U :METASPLOITABLE:<03>:U :METASPLOITABLE:<20>:U :WORKGROUP:<00>:G :WORKGROUP:<1e>:G :00:00:00:00:00:00
10.10.10.243  139    tcp              open   
10.10.10.243  445    tcp    smb       open   Unix Samba 3.0.20-Debian (language: Unknown) (domain:WORKGROUP)
10.10.10.243  512    tcp              open   
10.10.10.243  513    tcp              open   
10.10.10.243  514    tcp              open   
10.10.10.243  1099   tcp              open   
10.10.10.243  1524   tcp              open   
10.10.10.243  2049   udp    sunrpc    open   100003 v4
10.10.10.243  2049   tcp    sunrpc    open   100003 v4
10.10.10.243  3306   tcp    mysql     open   5.0.51a-3ubuntu5
10.10.10.243  3632   tcp              open   
10.10.10.243  5432   tcp    postgres  open   8.3.8
10.10.10.243  5900   tcp    vnc       open   VNC protocol version 3.3
10.10.10.243  6000   tcp              open   
10.10.10.243  6667   tcp              open   
10.10.10.243  6697   tcp              open   
10.10.10.243  8180   tcp              open   
10.10.10.243  8787   tcp              open   
10.10.10.243  40587  udp    sunrpc    open   100005 v3
10.10.10.243  42089  tcp    sunrpc    open   100005 v3
10.10.10.243  47361  tcp    sunrpc    open   100021 v4
10.10.10.243  53257  tcp    sunrpc    open   100024 v1
10.10.10.243  55600  udp    sunrpc    open   100024 v1
10.10.10.243  58825  udp    sunrpc    open   100021 v4

msf > notes 
[*] Time: 2012-07-19 01:35:46 UTC Note: host=10.10.10.2 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:35:47 UTC Note: host=10.10.10.200 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:03 UTC Note: host=10.10.10.239 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:05 UTC Note: host=10.10.10.200 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:16 UTC Note: host=10.10.10.238 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2008 Enterprise", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 1", :os_lang=>"Unknown"}
[*] Time: 2012-07-19 01:36:22 UTC Note: host=10.10.10.239 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:28 UTC Note: host=10.10.10.243 service=smb type=smb.fingerprint data={:os_flavor=>"Unix", :os_name=>"Unknown", :os_sp=>"Samba 3.0.20-Debian"}
[*] Time: 2012-07-19 01:36:33 UTC Note: host=10.10.10.238 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:34 UTC Note: host=10.10.10.243 service=139/tcp type=smb.domain.enumusers data={:sid_txt=>"5-21-1042354039-2475377354-766472396", :pass_min=>5, :pass_min_history=>0, :server_role=>3, :lockout_threshold=>0, :lockout_duration=>1480786430454, :lockout_window=>1480786430454, :users=>{1010=>"games", 501=>"nobody", 1210=>"bind", 1026=>"proxy", 1204=>"syslog", 3002=>"user", 1066=>"www-data", 1000=>"root", 1018=>"news", 1216=>"postgres", 1004=>"bin", 1016=>"mail", 1222=>"distccd", 1226=>"proftpd", 1202=>"dhcp", 1002=>"daemon", 1208=>"sshd", 1012=>"man", 1014=>"lp", 1218=>"mysql", 1082=>"gnats", 1200=>"libuuid", 1068=>"backup", 3000=>"msfadmin", 1224=>"telnetd", 1006=>"sys", 1206=>"klog", 1212=>"postfix", 3004=>"service", 1076=>"list", 1078=>"irc", 1214=>"ftp", 1220=>"tomcat55", 1008=>"sync", 1020=>"uucp"}, :name=>"METASPLOITABLE"}
[*] Time: 2012-07-19 01:36:36 UTC Note: host=10.10.10.243 service=139/tcp type=smb.shares data={:shares=>[["print$", "DISK", "Printer Drivers"], ["tmp", "DISK", "oh noes!"], ["opt", "DISK", ""], ["IPC$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"], ["ADMIN$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"]]}
[*] Time: 2012-07-19 01:35:33 UTC Note: host=10.10.10.2 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2003", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"Unknown"}

I hope you find these new commands useful.

Stories

Teasers & Plugs

  • DerbyCon Call for Papers and Ticket Registration is: available online. If you have not yet registered or submitted a talk, please do so now.
  • Security BSides everywhere: Cleveland, Las Vegas, Los Angeles more. http://www.securitybsides.com/ - We have 5 BSides tickets (only 3 left) to give away! Listen to the instructions at the end of Episode 282 for complete details, or submit a technical segement!

Paul's Stories

Larry's Stories

Allison's St0ri3s

Jack's Stories of bare knuckled brawling