192.168.86.48
49153
tcp msrpc open Microsoft Windows RPC
192.168.86.48
49154
tcp msrpc open Microsoft Windows RPC
192.168.86.48
49155
tcp msrpc open Microsoft Windows RPC
Based on this, we can go in numerous directions. It’s worth doing some service scan‐
ning, though, to see if we can get some additional details.
SMB Scanning
The Server Message Block (SMB) protocol has been used by Microsoft Windows as a
way to share information and manage systems remotely for many versions. Using this
protocol, we can gather a lot of details about our target. For starters, we can get the
operating system version as well as the name of the server. Metasploit modules can be
used to extract details from the target. While many of them require authentication,
some can be used without needing any login credentials. The first one we will look at,
as you can see in
Example 6-4
, is the
smb_version
module. This provides specifics
about our target system.
Example 6-4. Using smb_version against the target system
msf auxiliary
(
scanner/smb/smb2
)
> use auxiliary/scanner/smb/smb_version
msf auxiliary
(
scanner/smb/smb_version
)
>
set
RHOSTS 192.168.86.48
RHOSTS
=
> 192.168.86.48
msf auxiliary
(
scanner/smb/smb_version
)
> run
[
+
]
192.168.86.48:445 - Host is running Windows
2008
R2 Standard SP1
(
build:7601
)
(
name:VAGRANT-2008R2
)
(
workgroup:WORKGROUP
)
[
*
]
Scanned
1
of
1
hosts
(
100%
complete
)
[
*
]
Auxiliary module execution completed
Some systems will allow you to gather a list of shares directories that have been adver‐
tised on the network as being available to read or write to remotely without providing
credentials. If a system administrator is doing the right things, this wouldn’t be possi‐
ble. However, in the name of expedience, sometimes the wrong things are done. As a
result, it’s worth trying to enumerate the shares on remote systems.
Example 6-5
shows the use of
smb_enumshares
to acquire the shares that are exposed to the out‐
side world.
Example 6-5. Using msfconsole for scanning
msf auxiliary
(
scanner/smb/smb_enumusers_domain
)
> use auxiliary/scanner/smb/
smb_enumshares
msf auxiliary
(
scanner/smb/smb_enumshares
)
> show options
Module options
(
auxiliary/scanner/smb/smb_enumshares
)
:
Name Current Setting Required Description
