Scribd Logo
Upload

Welcome to Scribd!

  • 13 views

    Lab4 SE161942

    Uploaded by

    Nguyen Giang Nam (K16 HCM)
    Netdiscover and Nmap are used to find hosts on the local network and scan for open ports. Nmap finds many open ports on the Metasploitable 2 VM. Nmap scripts and tools like rpcclient, enum4linux are used to enumerate user accounts, revealing 35 users. The /tmp folder is shared, allowing potential script execution.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Lab4 SE161942

    Uploaded by

    Nguyen Giang Nam (K16 HCM)
    13 views8 pages
    Netdiscover and Nmap are used to find hosts on the local network and scan for open ports. Nmap finds many open ports on the Metasploitable 2 VM. Nmap scripts and tools like rpcclient, enum4linux are used to enumerate user accounts, revealing 35 users. The /tmp folder is shared, allowing potential script execution.

    Original Title

    Lab4_SE161942

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Netdiscover and Nmap are used to find hosts on the local network and scan for open ports. Nmap finds many open ports on the Metasploitable 2 VM. Nmap scripts and tools like rpcclient, enum4linux are used to enumerate user accounts, revealing 35 users. The /tmp folder is shared, allowing potential script execution.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    13 views8 pages

    Lab4 SE161942

    Uploaded by

    Nguyen Giang Nam (K16 HCM)
    Netdiscover and Nmap are used to find hosts on the local network and scan for open ports. Nmap finds many open ports on the Metasploitable 2 VM. Nmap scripts and tools like rpcclient, enum4linux are used to enumerate user accounts, revealing 35 users. The /tmp folder is shared, allowing potential script execution.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 8

    Project 5: Enumerating Metasploitable 2

    Setup
    Start your Kali VM and log in as kali with the password kali
    Start your Metasploitable 2 VM and log in as msfadmin with the password msfadmin
    Execute the ifconfig command on both machines and ping from one to the other. Make sure you
    get replies, as shown below.
    Task 1: Finding Hosts & Open Ports
    In Kali, execute this command to locate all hosts on your network.
    Replace the subnet address below with the correct subnet for your machine. Usually all you need
    is the first 3 bytes of
    the IP address, as highlighted in the image above.
    netdiscover -r 192.168.98.0/24
    As shown below, the scanner finds all the machines on your network. One of them should be
    your Metasploitable 2 machine.
    Press Ctrl+C to exit netdiscover.

    Execute this command to scan all 65,536 TCP ports on the target, replacing the IP address with
    the IP address of your Metasploitable 2 VM.
    nmap -sS -p- 192.168.98.134
    This scan quickly finds all open ports, as shown below, but it doesn't find versions of the
    services.
    Execute this command to scan 1000 common ports on the target, with version detection and OS
    detection. Replace the IP address with the IP address of your Metasploitable 2 VM.
    nmap -sS -sV -O 192.168.98.134
    This scan finds many version numbers, as shown below

    Execute this command to scan UDP ports on the target.


    nmap -sU 192.168.98.134
    This scan will take about 15 minutes to run, so leave it going and open a new Terminal window
    to continue with the rest of the project while it runs.
    When it finishes, it finds several UDP-based services, as shown below.
    Task 2: Enumerating Users
    Enumerating with Nmap
    Execute this command to run the Nmap script "smb-enum-users" on the target. This will find a
    list of user accounts from the SMB service, which is available if a host is sharing files with
    Windows systems.
    nmap --script smb-enum-users.nse -p 445 172.16.1.190
    This produces a long list of user accounts, as shown below.

    Enumerating with rpcclient


    You can also enumerate users via Null sessions with the "rpcclient" command. Execute this
    command:
    rpcclient -U "" 172.16.1.190
    When it asks for a password, press Enter.
    This displays an "rpcclient $>" prompt. Execute this command:
    querydominfo
    This shows that there are 35 users on the system, as shown below.
    Execute this command to list all 35 user accounts.
    enumdomusers
    This lists all the user accounts, with their "Relative ID" numbers (rid), as shown below.
    Execute this command to get more information about the "msfadmin" account.
    queryuser msfadmin
    This shows that user's profile path, and other information, as shown below.

    Execute the exit command to leave "rpcclient".

    Enumerating with enum4linux


    enum4linux is a Perl script that uses smbclient, rpcclient, net, and nmblookup to automatically
    enumerate a target.
    Execute this command to see the options for the enum4linux command.
    enum4linux --help
    Not specifying any options runs them all. Execute this command to enumerate the target:
    enum4linux 172.16.1.190
    A lot of output scrolls by. First there are a couple lists of all the usernames, as we found
    previously with other tools.
    Then a "Share Enumeration" appears, showing that the /tmp folder is shared, as shown below.
    This has a note of "oh
    noes!" because /tmp is world-writeable. This means we can probably upload scripts into that
    folder and execute them :).

    You might also like