Network Enumeration

NMAP

# Alive hosts
nmap -sn 10.0.0.0/24	

# scan the 1024 most common ports, run OS detection, run default nmap scripts
nmap -A -oA nmap <targetip>	

# Scan more deeply, scan all 65535 ports on $targetip with a full connect scan
nmap -v -sT <targetip> -p- 

# more options
nmap -sV -sC -v -A <targetip> -p- 
nmap -sT -sV -A -O -v -p 1–65535 <targetip> 

# my preference
nmap -sV -sC -v -oA output <targetip>
nmap -p- -v <targetip>


------------------------

SMB

Port 139 and 445- SMB/Samba shares
Samba is a service that enables the user to share files with other machines
works the same as a command line FTP client, may browse files without even having credentials

# Share List:
smbclient --list <targetip>
smbclient -L <targetip>

# Check SMB vulnerabilities:
nmap --script=smb-check-vulns.nse <targetip> -p445

# basic nmap scripts to enumerate shares and OS discovery
nmap -p 139,445 192.168.1.1/24 --script smb-enum-shares.nse smb-os-discovery.nse

# Connect using Username
root@kali:~# smbclient -L <targetip> -U username -p 445

# Connect to Shares
smbclient \\\\<targetip>\\ShareName
smbclient \\\\<targetip>\\ShareName -U john

# enumarete with smb-shares, -a “do everything” option
enum4linux -a 192.168.1.120

# learn the machine name and then enumerate with smbclient
nmblookup -A 192.168.1.102
smbclient -L <server_name> -I 192.168.1.105

# rpcclient - Connect with a null-session (only works for older windows servers)
rpcclient -U james 10.10.10.52
rpcclient -U "" 192.168.1.105
(press enter if asks for a password)
rpcclient $> srvinfo
rpcclient $> enumdomusers
rpcclient $> enumalsgroups domain
rpcclient $> lookupnames administrators
rpcclient> querydominfo
rpcclient> enumdomusers
rpcclient> queryuser john

# scan for vulnerabilities with nmap
nmap --script "vuln" <targetip> -p139,445

------------------------

SMTP

# telnet or netcat connection
nc <targetip> 25
VRFY root
# Check for commands
nmap -script smtp-commands.nse <targetip>

------------------------

Port 111 - RPC

Rpcbind can help us look for NFS-shares. So look out for nfs. Obtain list of services running with RPC:

rpcbind -p <targetip>
rpcinfo –p x.x.x.x

# using nmap, see which port NFS is listening
locate *rpc*.nse
nmap --script rpcinfo.nse <targetip> -p 111

-------------------------

NFS

# to find the public share
locate *nfs*.nse
nmap --script nfs-showmount.nse <targetip>

# mount the share to a folder under /tmp
mkdir /tmp/nfs
/sbin/mount.nfs <targetip>:/home/box /tmp/nfs