‫SMB, which stands for Server Message Block, is a protocol for sharing files, printers, serial ports
‫and communications abstractions such as named pipes and mail slots between computers.
‫In addition to that, Sambor is freely available SMB server for Unix.
‫It's an implementation of SMB for Unix like systems.
‫SMB can run directly over TCP ports one three seven one three nine four four five were on UDP ports
‫one three seven and one three eight.
‫Now some versions of SMB protocol has known vulnerabilities, so you should enumerate the assembly services.
‫Now let's step back into the lab to use MSF modules for SMB.
‫All right, so you have made a scan over Métis voidable two and three to check to see if the SMB port
‫is open, type the service's command with a P parameter and SMB port numbers one three nine and four,
‫four or five.
‫And the ports are open on both machines.
‫MSF has a meaningful directory structure.
‫So you can find SMB related auxillary scanners under this directory.
‫You're not going to need to write every word, just hit the tab button to complete the commands.
‫Now, the basic logic behind the enumeration is service banner and version detection, so that means
‫I will first run the SMB version module show options.
‫And set our hosts to our target IP addresses.
‫And then you can run the module.
‫That module executed very quickly, but look at that, though, it does bring some really good information
‫about the target.
‫So as you can see, ten point ten to ten is a Windows Server 2008 R2 Standard Service back one, which
‫is Métis voidable three.
‫On the other hand, Métis voidable two has Semba.
‫Now, why is the version detection important?
‫I hear you saying and scratching your head.
‫Well, let's have a look at this Sambor version.
‫This version of Sanba has a vulnerability.
‫Even Métis boy has an exploit for this, so I think you get the point.
‫But just one more point here.
‫Métis Point saves this information to improve your penetration test.
‫So let's type hosts as our command with PSY as a parameter.
‫Now you see Windows seven changed through Windows 2008.
‫So now let's go with another module, you can try all the others, but.
‫I'm going to choose SMB Mouse one seven 10, so the options.
‫Set the host variable.
‫And run the module.
‫And it looks like deployable three is vulnerable to MS 17 through 10.
‫So let's let's Google this vulnerability, shall we?
‫There are many topics about this vulnerability, and that is Boite has an exploit module for that particular
‫vulnerability.
‫So that's a good way, I think, to illustrate how enumeration gives you better results.
‫So make a note of this vulnerability.
‫You're going to need it later.
‫OK, so let's go back to the MSF council.
‫All right, so this is the last one.
‫This is the SMB login module.
‫I will immediately set our host.
‫Now, I'll need a dictionary file to brute force.
‫So in a new tab.
‫I will create one.
‫For this, you can use the cool tool.
‫It's really simple and very handy.
‫The.
‫So how deep our crawl target page and em for minimum character numbers, for words in the dictionary.
‫And then the name of the output file.
‫So here, I'm going to use the address of the GitHub page of Métis Voidable three is the target page
‫that Google will derive the words from.
‫So this process can take way too much time, but I'm going to stop it here because the dictionary file
‫has already been created.
‫So let's go back to the MSF console and use it.
‫I'll set the SMB user to vagrant.
‫So at the pass, fail to that dictionary file.
‫And then run the module.
‫So I'm going to interrupt the execution.
‫Did you see at the beginning of the output, did you notice the green color?
‫That's because you need to enter the pair, vagrant, vagrant.
‫OK, so that's what we need.
‫So make a note of that.
‫Now, SMB reveal is the valuable information that you get.