Smb/smb enumusers
De www.metasploit-es.com.ar
El escaneador "smb_enumusers" conectara a cada uno de los sistemas via el servicio SMB RPC y enumerara los usuarios del sistema.
msf > use auxiliary/scanner/smb/smb_enumusers msf auxiliary(smb_enumusers) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads msf auxiliary(smb_enumusers) > set RHOSTS 192.168.1.150-165 RHOSTS => 192.168.1.150-165 msf auxiliary(smb_enumusers) > set THREADS 16 THREADS => 16 msf auxiliary(smb_enumusers) > run [*] 192.168.1.161 XEN-XP-SP2-BARE [ ] [*] 192.168.1.154 METASPLOITABLE [ games, nobody, bind, proxy, syslog, user, www-data, root, news, postgres, bin, mail, distccd, proftpd, dhcp, daemon, sshd, man, lp, mysql, gnats, libuuid, backup, msfadmin, telnetd, sys, klog, postfix, service, list, irc, ftp, tomcat55, sync, uucp ] ( LockoutTries=0 PasswordMin=5 ) [*] Scanned 05 of 16 hosts (031% complete) [*] Scanned 12 of 16 hosts (075% complete) [*] Scanned 15 of 16 hosts (093% complete) [*] Scanned 16 of 16 hosts (100% complete) [*] Auxiliary module execution completed
Podemos ver que ejecutando el escaneo sin credenciales, solamente el servicio Linux Samba muestra un listado de usuarios. Pasando un conjunto valido de credenciales al escaneador enumerara los usuarios en nuestros objetivos.
msf auxiliary(smb_enumusers) > set SMBPass s3cr3t SMBPass => s3cr3t msf auxiliary(smb_enumusers) > set SMBUser Administrator SMBUser => Administrator msf auxiliary(smb_enumusers) > run [*] 192.168.1.150 V-XPSP2-SPLOIT- [ Administrator, Guest, HelpAssistant, SUPPORT_388945a0 ] [*] Scanned 04 of 16 hosts (025% complete) [*] 192.168.1.161 XEN-XP-SP2-BARE [ Administrator, Guest, HelpAssistant, SUPPORT_388945a0, victim ] [*] 192.168.1.160 XEN-XP-PATCHED [ Administrator, ASPNET, Guest, HelpAssistant, SUPPORT_388945a0 ] [*] Scanned 09 of 16 hosts (056% complete) [*] Scanned 13 of 16 hosts (081% complete) [*] Scanned 15 of 16 hosts (093% complete) [*] Scanned 16 of 16 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(smb_enumusers) >
Ahora que hemos pasado credenciales al escaneador, la maquina Linux no devuelve el conjunto de usuarios porque las credenciales no son validas para ese sistema. Este es un ejemplo de porque merece la pena ejecutar el escaneador en diferentes configuraciones.
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
