Adrian Crenshaw

 I run Irongeek.com  I have an interest in InfoSec education  I don’t know everything - I’m just a geek with time on my hands  Sr. Information Security Consultant at TrustedSec  Co-Founder of Derbycon

 Skydogcon wanted something basic, decided to use it at Hack3rcon too  Who cares about Domain Admin if you can get the data without it  Ok, my ego cares, but…  Get the data  Trojan the EXEs  Add your SSH keys  Vulnerabilities get patched, common configuration mistakes last forever  Everybody screws it up

 Server Message Block Protocol  Evolved into Common Internet File System (CIFS)  Communicates over  445/TCP or  137/UDP, 138/UDP, & 137/TCP, 139/TCP or  NetBEUI  Also supports Inter-Process Communication (IPC) named pipes

 Invented by IBM  Microsoft used it in its answer to Novell Netware, LAN Manager  Samba uses in it *nix environments  Changed over the years  SMB 2  SMB 2.1  SMB 3.0  SMB 3.02

 Windows 2000 & XP

 Windows NT 4/2000: Anonymous Security identifier (SID) was part of Everyone metagroup  Windows XP forward, it is not, must be authenticated  Homegroup?  Share Level vs NTFS Permissions  What version of Windows?  Authenticate with Microsoft account?

 $ suffix hides from built in Windows tools, but not others  Admins think it does  Not the same as Samba’s browseable=no setting  About the same thing as not broadcasting your SSID

 How easy is it to integrate with current authentication?  Samba  AS/400  OS X  SOHO NAS

 Anonymous  Local Hash (WCE or Built-in to the tool)  Null Sessions 1. nslookup domainname 2. enum4linux -a someip > enum4linux-a.txt 3. grep "Domain Users" enum4linux-a.txt |cut -d '\' -f 2 > users.txt 4. hydra -L users.txt -P passwords.txt smb 5. hydra -L users.txt -e nsr smb  Responder and crack challenge response

 WCE wce.exe -g somepassword wce.exe -s someuser:somedomain:90172B990B993E317 6FDE78389BE2CE2:DE4DB66B3AFD1319F4442 D FAC

 Based on NetBIOS service location protocol  net view

1. use auxiliary/scanner/smb/smb_enumshares 2. set rhosts /24 3. set smbuser adrian 4. set SMBpass somepassword 5. set spidershares true 6. set showfiles true 7. set threads run

 nmap -sU -sS --script smb-enum- shares.nse -p U:137,T:139, script-args smbusername=adrian,smbpassword=some pass --open /24  smbhash  shares.html shares.html

Nmap scan report for Cthulhu ( ) Host is up (0.078s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds 137/udp open netbios-ns MAC Address: A4:17:31:02:7B:50 (Hon Hai Precision Ind. Co.) Host script results: | smb-enum-shares: | ADMIN$ | Anonymous access: | Current user ('adrian') access: | C | Anonymous access: | Current user ('adrian') access: READ | C$ | Anonymous access: | Current user ('adrian') access: | IPC$ | Anonymous access: READ |_ Current user ('adrian') access: READ Nmap done: 256 IP addresses (10 hosts up) scanned in seconds

 Quickly know what access you have

 General->Up thread count  Additional->Grab HTTP & FTP server banner  Work Stations->Lookup logged on users  Share->Enumerate All

Getting the most out of shares

 Use operators in CAPITALS

  \d{3}-\d{2}-\d{4}|\d{9}|(?i)ssn  grepWin  AstroGrep



Tweaks to secure and scan better

 Deny access to this computer from the network  Under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LmC ompatibilityLevel  SecPol.msc

LevelGroup Policy NameSendsAcceptsProhibits Sending 0 Windows NT 4, 2000, XP Send LM and NTLM Responses LM, NTLM NTLMv2 Session Security is negotiated LM, NTLM, NTLMv2NTLMv2 Session Security (on Windows 2000 below SRP1, Windows NT 4.0, and Windows 9x) 1Send LM and NTLM— use NTLMv2 session security if negotiated LM, NTLM NTLMv2 Session Security is negotiateda LM, NTLM, NTLMv2NTLMv2 2Send NTLM response only NTLM NTLMv2 Session Security is negotiated LM, NTLaM, NTLMv2LM and NTLMv2 3 Vista, 7, etc. Send NTLMv2 response only NTLMv2 Session Security is always used LM, NTLM, NTLMv2LM and NTLM 4Send NTLMv2 response only/refuse LM NTLMv2 Session Security NTLM, NTLMv2LM 5Send NTLMv2 response only/refuse LM and NTLM NTLMv2, Session Security NTLMv2LM and NTLM Based on

 Finding Rogue SMB File Shares On Your Network uefileshares uefileshares  Finding the Leaks leaks.html leaks.html  nessuscmd Tip: Finding Open SMB File Shares finding-open-smb-file-shares finding-open-smb-file-shares

Derbycon Sept 23th-27th, Others Photo Credits to KC (devauto) Derbycon Art Credits to DigiP

42