In this lesson,
we're going to focus on service discovery
with a particular emphasis on SMB, file shares,
RPC and DCOM.
We'll explore how to identify
and exploit these services
to move laterally within a network during a pen test,
starting with SMB file shares.
SMB, or Server Message Block,
is a protocol used for sharing files, printers,
and other resources on a network.
Identifying SMB file shares can reveal
valuable information and access points.
Tools like Nmap and SMBclients
are commonly used for this purpose.
For instance, using Nmap
with the --script smb-enum-shares option
can help you identify shared resources on a target machine.
Once identified, you can use
the SMBClient to connect to these shares
and explore their contents.
You can use the following command to accomplish this,
replacing, of course, the target_ip
with IP address of your target.
After identifying SMB shares,
the next step is to exploit them.
This can involve accessing unsecured shares,
exploiting weak permissions,
or using captured credentials to gain access.
Tools like Metasploit can automate these tasks.
Metasploit's smb_login module
can be used to attempt login
with various credentials,
while the smb_enumusers module can list user accounts.
Next, let's discuss RPC (Remote Procedure Call).
RPC allows programs to request services
from programs on other computers within a network.
For example, a finance application
on one server might use RPC
to request transaction processing service
from a database server on another computer
within the same network.
This allows the finance application
to perform complex transactions
without having to handle the processing locally.
Now, identifying RPC services can provide
entry points for lateral movement.
Nmap's rpcinfo script can be used
to discover RPC services
running on a target machine by using the following command.
nmap --script rpcinfo, and then you insert the target_ip.
Once RPC services are identified,
exploiting them can involve taking advantage
of known vulnerabilities or misconfigurations.
For instance, certain RPC services might be vulnerable
to remote code execution attacks,
which can be exploited by using Metasploit modules.
By exploiting these vulnerabilities,
you can execute arbitrary code on the target machine,
gaining further access to the network.
Let's consider a real-world example,
which features the WannaCry ransomware attack in 2017,
which exploited the CVE-2017-0143 vulnerability.
This vulnerability was found in Microsoft's SMB protocol,
which uses RPC for communication.
Attackers created an exploit known as EternalBlue,
which exploited this vulnerability.
EternalBlue could send specially-crafted packets
to the SMB service on the target machine, the vulnerability,
and allowing the attacker to run code on the system.
The WannaCry attack used EternalBlue to spread ransomware.
Once a machine was infected,
WannaCry would encrypt
the victim's files and display
a ransom note demanding payment in Bitcoin.
The ransomware then used
the same SMB vulnerability to spread
to other vulnerable machines on the same network,
creating a rapid and widespread infection.
Finally, let's look at DCOM,
or Distributed Component Object Model.
DCOM is a technology developed by Microsoft
that allows software components to communicate
with each other over a network.
Think of it as a way for different programs
possibly on different computers to work together
and share information,
making it easier to build complex applications.
Identifying DCOM services can reveal
additional attack vectors.
Tools like Metasploit and PowerShell scripts
can be used to enumerate DCOM services on target machines.
For example, we can use
the Get-WmiObject function in the following command.
The command Get-WmiObject -Class Window32_DCOMApplication
is used to gather information about DCOM applications
on a Windows computer.
It acts the system to list
all the DCOM applications installed
and provides details about them,
which could help us, as penetration testers,
understand what DCOM components are running on that machine.
Exploiting DCOM typically involves exploiting
vulnerabilities or using it to execute commands remotely.
Metasploit's dcomexec module can be used
to execute commands on target machines through DCOM.
This can be very useful
for moving laterally within a network
as it allows you to execute commands
with the privileges of the DCOM service.
So remember,
when performing service discoveries,
focus on identifying and exploiting SMB file shares,
RPC and DCOM services.
By using tools like Nmap, SMBClient, Metasploit,
and PowerShell, you can uncover valuable information
and access points, enabling you
to move laterally within the network
to achieve your penetration testing objective.
Understanding and mastering these techniques
will enhance your ability
to assess an attack's complex network environments.