Smb/smb enumshares
De www.metasploit-es.com.ar
El modulo "smb_enumshares", como seria de esperar, enumera cualquier SMB compartido disponible en el sistema remoto.
msf > use auxiliary/scanner/smb/smb_enumshares msf auxiliary(smb_enumshares) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads msf auxiliary(smb_enumshares) > set RHOSTS 192.168.1.150-165 RHOSTS => 192.168.1.150-165 msf auxiliary(smb_enumshares) > set THREADS 16 THREADS => 16 msf auxiliary(smb_enumshares) > run [*] 192.168.1.154:139 print$ - Printer Drivers (DISK), tmp - oh noes! (DISK), opt - (DISK), IPC$ - IPC Service (metasploitable server (Samba 3.0.20-Debian)) (IPC), ADMIN$ - IPC Service (metasploitable server (Samba 3.0.20-Debian)) (IPC) Error: 192.168.1.160 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) Error: 192.168.1.160 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) [*] 192.168.1.161:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) Error: 192.168.1.162 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) Error: 192.168.1.150 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) Error: 192.168.1.150 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) [*] Scanned 06 of 16 hosts (037% complete) [*] Scanned 09 of 16 hosts (056% complete) [*] Scanned 10 of 16 hosts (062% complete) [*] Scanned 14 of 16 hosts (087% complete) [*] Scanned 15 of 16 hosts (093% complete) [*] Scanned 16 of 16 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(smb_enumshares) >
Como puedes ver, y ya que este es un escaneo sin credenciales, se deniega el acceso a la mayoria de los sistemas probados. Pasando credenciales de usuario al escaneador producira resultados muy diferentes.
msf auxiliary(smb_enumshares) > set SMBPass s3cr3t SMBPass => s3cr3t msf auxiliary(smb_enumshares) > set SMBUser Administrator SMBUser => Administrator msf auxiliary(smb_enumshares) > run [*] 192.168.1.161:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) [*] 192.168.1.160:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) [*] 192.168.1.150:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) [*] Scanned 06 of 16 hosts (037% complete) [*] Scanned 07 of 16 hosts (043% complete) [*] Scanned 12 of 16 hosts (075% complete) [*] Scanned 15 of 16 hosts (093% complete) [*] Scanned 16 of 16 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(smb_enumshares) >
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
