Enumeration p7

Lab 6

Enumerating the System Using Hyena

Hyena uses an Explorer-styk interfacefora// operations, including right mouse dick pop-/p context menus for all objects. Management of users, groups (both local and global), shares, domains, computers, services, devices, events, files, printers andprint jobs, sessions, open files, disk space, user rights, messaging, expo/ting job scheduling, processes, andprinting are all suppo/ted.

Lab Scenario

The hacker enumerates applications and banners m addition to identifying user accounts and shared resources. in tliis lab. Hyena uses an Explorer-style interface for all operations, management of users, groups (bodi local and global), shares, domains, computers, services, devices, events, tiles, printers and print jobs, sessions, open tiles, disk space, user nglits, messaging, exporting, job scheduling, processes, and printing are all supported. To be an expert ethical hacker and penetration tester, you must have sound knowledge of enumeration, which requires an active connection to the maclune being attacked.

Lab Objectives

The objective of this lab is to help suidents learn and perform network enumeration:
■ Users information in  the system
■ Services running in the system

Lab Environment

To perform the lab, you need:
■ A computer ranning Windows Server 2012
■ Administrative privileges to install and run tools
■ You can also download tins tool from following link http://www. systemtools.com/livena/download.litm
■ If you decided to download latest version of tins tool screenshots may differ

Lab Duration

Time: 10 Minutes

Overview of Enumeration

Enumeration is die process of extracting user names, machine names, network resources, shares, and sendees from a system. Enumeration techniques are conducted in an intranet environment

Lab Tasks

The basic idea in diis section is to:

FIGURE 6.1: Installation of Hyena

3. The Software License Agreement window appears, you must accept the agreement to install Hyena.
4. Select I ac c ept the terms of the license agreement to continue and click Next.

FIGURE 6.2: Select die Agreement

5. Choose die destination location to install Hyena.
6. Click Next to continue the installation.

FIGURE 6.3: Selecting folder for installation

7. The Ready to install the Program window appears. Click Install

FIGURE 6.4: selecting installation type

8. The InstallShield Wizard complete window appears. Click Finish ro complete die installation.

FIGURE 6.5: Ready to install window

9. Launch the Start menu by hovering the mouse cursor on the lower left corner of the desktop.

FIGURE 6.6: Windows Seiver 2012—Desktop view

10.Click the Hyena app to open the Hyena window.

FIGURE 6.7: Windows Server 2012 — Apps

11. The Registration window will appear. Click OK to continue.
12. The main window of Hyena is shown 111 following figiire.

13. Click + to expand Local workstation, and then click Users.

FIGURE 6.9: Expand the System users

14. To check the services running on the system, double-click Services

FIGURE 6.10: Sendees running in the system

15. To check the User Rights, click + to expand it

FIGURE 6.11: Users Rights

16. To check the Scheduled jobs, click + to expand it.

FIGURE 6.12: Scheduled jobs

Lab Analysis

Analyze and document the results related to die lab exercise. Give your opinion on your target’s security ״ posture and exposure.

Thêm chú thích

Enumeration p6

Lab 5

Enumerating a Network Using SolavWinds Toolset

The SolarWinds Toolset provides the tools yon need ns a network engineer or netn ork consultant to get your job done. Toolset includes best-of-breed solutions that work sit/ply and precisely, providing the diagnostic, peiformance, and bandwidth measurements you want, without extraneous, nnnecessay features.

Lab Scenario

Penetration testing is much more than just running exploits against vulnerable systems like we learned in the previous module. in fact a penetration test begins before penetration testers have even made contact with die victim systems. Rather dian blindly dirowing out exploits and praying diat one of them returns a shell, penetration tester meticulously study the environment for potential weaknesses and their mitigating factors. Bv the time a penetration tester runs an exploit, he or she is nearly certain diat it will be successful. Since failed exploits can in some cases cause a crash or even damage to a victim system, or at die very least make the victim un- exploitable in the future, penetration testers won't get the best results. 111 tins lab we enumerate target system services, accounts, hub ports, TCP/IP network, and routes. You must have sound knowledge of enumeration, which requires an active connection to the macliine being attacked. A hacker enumerates applications and banners in addition to identifying user accounts and shared resources.

Lab Objectives

The objective of tins lab is to help students learn and perform NetBIOS enumeration. NetBIOS enumeration is carried out to detect:
■ Hardware MAC addresses across routers
■ Hidden shared folders and writable ones
■ Internal and external IP addresses

Lab Environment

To earn’ out the lab, you need:

■ SolarWinds-Toolset-V10 located at D:\CEH-Tools\CEHv8 Module 04 Enumeration\SNMP Enumeration Tools\SolarWind’s IP Network Browser
■ You can also download the latest version of SolarWinds Toolset Scanner Irom the link http:/ /www.solarwmds.com/
■ If you decide to download the latest version, then screenshots shown in the lab might differ
■ Run this tool in Windows Server 2012 Host machine and Windows Server 2008 virtual machine
■ Administrative privileges are required to run this tool
■ Follow the wizard-driven installation instructions

Lab Duration

Time: 5 Minutes

Overview of Enumeration

Enumeration involves an active connection so that it can be logged. Typical information diat attackers are looking for includes user account names lor future password guessing attacks.

Lab Task

1. Configure SNMP services and select Start ־־>Control Panel ־.>Administrative Tools ־־> Services.

FIGURE 5.1: Setting SNMP Services

2. Double-click SNMP service.
3. Click die Security tab, and click Add... The SNMP Services Configuration window appears. Select READ ONLY from Community rights and Public in  Community Name, and click Add.

FIGURE 5.2: Configuring SNMP Services

4. Select Accept SNMP packets from any host, and click OK.

FIGURE 5.3: setting SNMP Services

5. Install SolarWinds-Toolset-V10, located in D:\CEH-Tools\CEHv8 Module 04 Enumeration\SNMP Enumeration Tools\SolarWind’s IP Network Browser.
6. Launch the Start menu by hovering the mouse cursor on the lower-left corner of the desktop.

FIGURE 5.4: Windows Server 2012—Desktop view

7. Click the Workspace Studio app to open the SolarWinds Workspace
Studio window.

FIGURE 5.5: Windows Server 2012—Apps

6. ־nie main window of SolarWinds Workspace Studio is shown in the following figure.

FIGURE 5.6 Solarwinds workspace studio main window

7. Click External Tools, and then select Classic tools -> Network Discovery -> IP Network Browser.

FIGURE 5.7: Menu Escalation for IP network browser

8. IP Network Browser will be shown. Enter die Windows 8 Virtual Machine IP address (10.0.0.7) and click Scan Device ( the IP address will be different in  your network).

FIGURE 5.8: IP Network Browser windows

9. It will show die result in a line widi die IP address and name ot die computer diat is being scanned.
10. Now click the Plus (+) sign before die IP address.

FIGURE 5.9: IP Network Browser windows results page

11. It will list all die information ot die targeted IP address

FIGURE 5.10: IP Network Browser windows results page

Lab Analysis

Analyze and document die results related to die lab exercise.

Questions
1. Analyze the details of die system such as user accounts, system MSI, hub ports, etc.
2. Find the IP address and Mac address of the system.

Enumeration p5

Lab 4

Enumerating a Network Using SoftPerfect Network Scanner

SoftPerfect Netirork Scanner is a free multi-threaded IP, NetBIOS, and SNMP scanner nith a modern interface and many advanced feat!ires.

Lab Scenario
To be an expert ethical hacker and penetration tester, you must have sound knowledge of enumeration, which requires an active connection to the machine being attacked. A hacker enumerates applications and banners IN  addition to identifying user accounts and shared resources, hi this lab we try to resolve host names and auto-detect vour local and external IP range.

Lab Objectives

The objective of this lab is to help students learn and perform NetBIOS enumeration. NetBIOS enumeration is carried out to detect:
■ Hardware MAC addresses across routers
■ Hidden shared folders and writable ones
■ Internal and external IP address

Lab Environment

To carry out the lab, you need:

■ SoftPerfect Network Scanner is located at D:\CEH-Tools\CEHv8 Module 04 Enumeration\SNMP Enumeration Tools\SoftPerfect Network Scanner
■ You can also download the latest version of SoftPerfect Network Scanner from the link http: / /www.sottpertect.com/products/networkscanner/

■ If you decide to download the latest version, then screenshots shown 111 the lab might differ
■ Run tliis tool 111 Windows 2012 server
■ Administrative privileges are required to run this tool

Lab Duration

Tune: 5 A !unites

Overview of Enumeration

Enumeration involves an active connection so diat it can be logged. Typical information diat attackers are looking for nicludes user account names for future password-guessnig attacks.

Lab Task

1. To launch SoftPerfect Network Scanner, navigate to D:\CEH-Tools\CEHv8 Module 04 Enumeration\SNMP Enumeration Tools\SoftPerfect Network Scanner
2. Double-click netscan.exe

FIGURE 4.1: SoftPerfect Network Scanner main window

3. To start scanning your network, enter an IP range IN THE Range From field
and click Start Scanning.

FIGURE 4.2: SoftPerfect setting an IP range to scan

4. The status bar displays the status ot the scamied IP addresses at die bottom of die window.

FIGURE 4.3: SoftPerfect status bar

5. To view die properties of an individual IP address, nght-click diat particular IP address

FIGURE 4.4: SoftPerfect IP address scanned details

Lab Analysis

Analyze and document die results related to die lab exercise.

Questions
1. Examine die detection of die IP addresses and MAC addresses across routers.
2. Evaluate die scans for listening ports and some UDP and SNMP services.
3. How would you launch external third-party applications?

Enumeration p4

Lab 3

Enumerating NetBIOS Using the NetBIOS Enumerator Tool

Enumeration is the process of probing identified servicesfor known weaknesses.

Lab Scenario

Enumeration is the first attack ON a target network; enumeration is the process of gathering the information about a target machine by actively connecting to it. Discover NetBIOS name enumeration with NBTscan. Enumeration means to identify die user account, system account, and admin account. in tins lab, we
enumerate a machine’s user name, MAC address, and domain group. You must have sound knowledge of enumeration, a process that requires an active connection to the machine being attacked. A hacker enumerates applications and banners in  addition to identifying user accounts and shared resources.

Lab Objectives

The objective of this lab is to help students learn and perform NetBIOS enumeration.
Tlie purpose of NetBIOS enumeration is to gather the following information:

■ Account lockout threshold

■ Local groups and user accounts

■ Global groups and user accounts

■ To restrict anonymous bypass routine and also password checking for user accounts with:

• Blank passwords
• Passwords that are same as the username in lower case

Lab Environment

To earn־ out die lab, you need:

■ NETBIOS Enumerator tool is located at D:\CEH-Tools\CEHv8 Module
04 Enumeration\NetBIOS Enumeration Tools\NetBIOS Enumerator
■ You can also download the latest version of NetBIOS Enumerator from the link http:// nbtenum.sourceforge.11et/
■ If you decide to download the latest version, then screenshots shown m the lab might differ
■ Run tins tool in Windows Server 2012
■ Administrative privileges are required to run this tool

Lab Duration

Time: 10 Minutes

Overview of Enumeration

Enumeration involves making active connections, so that they can be logged. Typical information attackers look for in enumeration includes user account names for future password guessing attacks. NetBIOS Enumerator is an enumeration tool that shows how to use remote network support and to deal with some other interesting web techniques, such as SMB.

Lab Tasks

1. To launch NetBIOS Enumerator go to D:\CEH-Tools\CEHv8 Module 04 Enumeration\NetBIOS Enumeration Tools\NetBIOS Enumerator, and double-click NetBIOS Enumerater.exe.

FIGURE 3.1: NetBIOS Enumerator main window

2. In the IP range to scan section at the top left of the window, enter an IP range in from and to text fields.

3. Click Scan.

FIGURE 3.2: NetBIOS Enumerator with IP range to scan

4. NetBIOS Enumerator starts scanning for die range of IP addresses provided.
5. After the compledon of scanning, die results are displayed in die left pane of die window.
6. A Debug window section, located 111 the right pane, show’s the scanning of die inserted IP range and displays Ready! after completion of the scan.

FIGURE 3.3: NetBIOS Enumerator results

7. To perform a new scan 01־ rescan, click Clear.
8. If you are going to perform a new scan, die previous scan results are erased.

Lab Analysis

Analyze and document die results related to die lab exercise.

Enumeration p3

Lab 2

Enumerating NetBIOS Using the SuperScan Tool

SuperScan is a TCP port scanner, pinger, and resolver. The tool's features include extensive Windows host enumeration capability, TCP S Y N scanning, and UDP scanning.

Lab Scenario

During enumeration, information is systematically collected and individual systems are identified. The pen testers examine the systems in their entirety; tins allows evaluating security weaknesses. in this lab we extract die information of NetBIOS information, user and group accounts, network shares, misted domains, and services, which are either running or stopped. SuperScan detects open TCP and UDP ports on a target machine and determines which services are nuining on those ports; by using this, an attacker can exploit the open port and hack your machine. As an expert ethical hacker and penetration tester, you need to enumerate target networks and extract lists of computers, user names, user groups, machine names, network resources, and services using various enumeration techniques.

Lab Objectives

The objective of tins lab is to help students learn and perform NetBIOS enumeration. NetBIOS enumeration is carried out to obtain:
■ List of computers that belong to a domain
■ List of shares on the individual hosts on the network
■ Policies and passwords


Lab Environment

To carry* out the lab , you need:

■ SuperScan tool is located at D:\CEH-Tools\CEHv8 Module 04 Enumeration\NetBIOS Enumeration Tools\SuperScan
■ You can also download the latest version of SuperScan from tins linkc http://www.mcatee.com/us/downloads/tree-tools/superscan.aspx
■ A computer running Windows Server 2012 as host machine
■ Windows 8 running on a virtual macliine as target machine
■ Administrative privileges to install and run tools
■ A web browser with an Internet connection

Lab Duration

Time: 10 Minutes

Overview of NetBIOS Enumeration

1. The purpose ot NetBIOS enumeration is to gather information, such as:

a. Account lockout threshold
b. Local groups and user accounts
c. Global groups and user accounts
2. Restnct anonymous bypass routine and also password checking:

a. Checks for user accounts with blank passwords
b. Checks for user accounts with passwords diat are same as die usernames in lower case

Lab Tasks

1. Double-click the SuperScan4 file. The SuperScan window appears.

2. Click the Windows Enumeration tab located on the top menu.
3. Enter the Hostname/IP/URL 111 the text box. in this lab, we have a Windows 8 virtual machine IP address. These IP addresses may van  in lab environments.

4. Check the types of enumeration you want to perform.
5. Now, click Enumerate.

FIGURE 2.2: SuperScan main window with IP address

6. SuperScan starts enumerating the provided hostname and displays the results in the right pane of the window

FIGURE 2.3: SuperScan main window with results

7. Wait for a while to complete the enumeration process.

8. Atter the completion of the enumeration process, an Enumeration completion message displays.

FIGURE 2.4: SuperScan main window with results

9. Now move the scrollbar up to see the results of the enumeration.

10. To perform a new enumeration on another host name, click the Clear button at the top right of the window. The option erases all the previous results.

FIGURE 2.5: SuperScan main window with resul

Lab Analysis

Analyze and document die results related to die lab exercise. Give your opinion on your target’s security posture and exposure.

Questions

1. Analyze how remote registry enumeration is possible (assuming appropriate access nghts have been given) and is controlled by the provided registry.txt tile.
2. As far as stealth is concerned, tins program, too, leaves a rather large footprint in die logs, even 111 SYN scan mode. Determine how you can avoid tins footprint 111 the logs.

Thêm chú thích

Enumeration p2

Lab 1

Enumerating a Target Network Using Nmap

Enumeration is the process of extracting user names , machine names , network resources , shares , and services from a system 

Lab Scenario

In fact, a penetration test begins before penetration testers have even made contact with the victim systems. During enumeration, information is systematically collected and individual systems are identified. The pen testers examine the systems in their entirety, which allows evaluating security weaknesses. in tliis lab, we discus Nmap; it uses raw IP packets in novel ways to determine what hosts are available on die network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet biters/firewalls are in use, it was designed to rapidly scan large networks. By using the open ports, an attacker can easily attack the target machine to overcome this type of attacks network filled with IP filters, firewalls and other obstacles. As an expert ethical hacker and penetration tester to enumerate a target network and extract a list ot computers, user names, user groups, machine names, network resources, and services using various enumeration techniques.

Lab Objectives

The objective ot tins lab is to help students understand and perform enumeration on target network using various techniques to obtain:

■ User names and user groups
■ Lists of computers, their operating systems, and the ports on them
■ Machine names, network resources, and services
■ Lists of shares on the individual hosts on die network
■ Policies and passwords


Lab Environment

To perform die kb, you need:

■ A computer running Windows Server 2008 as a virtual machine
■ A computer running with Windows Server 2012 as a host machine
■ Nmap is located at D:\CEH-Tools\CEHv8 Module 04 Enumeration\Additional Enumeration Pen Testing Tools\Nmap
■ Administrative privileges to install and mil tools

Lab Duration

Time: 10 Minutes

Overview of Enumeration

Enumeration is die process of extracting user names, machine names, network resources, shares, and services from a system. Enumeration techniques are conducted in an intranet environment

Lab Tasks

The basic idea in diis section is to:
■ Perform scans to find hosts with NetBIOS ports open (135,137-139, 445)
■ Do an nbtstat scan to find generic information (computer names, user names, ]MAC addresses) on the hosts
■ Create a Null Session to diese hosts to gain more information
■ Install and Launch Nmap in a Windows Server 2012 machine
1. Launch the Start menu by hovering the mouse cursor on the lower-left corner of the desktop.

FIGURE 1.1: Windows Server 2012—Desktop view

2. Click the Nmap-Zenmap GUI app to open the Zenmap window.

FIGURE 1.2: Windows Server 2012—Apps

3. Start your virtual machine running WMcwsSetver2008
4. Now launch die nmap tool 111 die Windows Server 2012 host machine.
5. Perform nmap -O scan for die Windows Server 2008 virtual machine (10.0.0.6) network. Tins takes a few minutes.
Note: IP addresses may vary 111 your lab environment.

FIGURE 1.3: Hie Zenmap Main window

6. Nmap performs a scan for die provided target IP address and outputs die results on die Nmap Output tab.
7. Your tirst target is die computer widi a Windows operating system on which you can see ports 139 and 445 open. Remember tins usually works onlv against Windows but may partially succeed it other OSes have diese ports open. There may be more dian one system diat has NetBIOS open

FIGURE 1.4: The Zenmap output window

8. Now you see that ports 139 and 445 are open and port 139 is using NetBIOS.
9. Now launch die command prompt 111 Windows Server 2008 virtual machine and perform nbtstat on port 139 ot die target machine.
10. Run die command nbtstat -A 10.0.0.7.

FIGURE 1.5: Command Prompt with die nbtstat command

11. We have not even created a null se ssion (an unaudienticated session) yet, and we can still pull tins info down.

12. Now create a null session.

13. 111 the command prompt, type net use \\X.X.X.X\IPC$ /u:”” (where X.X.X.X is die address of die host machine, and diere are no spaces between die double quotes).

FIGURE 1.6: The command prompt with the net use command

14. Confirm it by issuing a genenc net use command to see connected null sessions from your host.
15. To confirm, type net use, which should list your newly created null session.

FIGURE 1.7: The command prompt ,with the net use command

Lab Analysis

Analyze and document die results related to die lab exercise. Give your opinion on your target’s security posture and exposure.

Questions

1. Evaluate what nbtstat -A shows us for each of the Windows hosts.
2. Determine the other options ot nbtstat and what each option outputs.
3. Analyze the net use command used to establish a null session on the target machine.