3.1 Network Exploitation Basics
Third section in Complete Beginner learning path.
Last updated
Third section in Complete Beginner learning path.
Last updated
An exploration of common network service vulnerabilities and misconfigurations.
SMB is a client-server communication protocol for sharing access to files, printers, serial ports and other resources. This is known as a response-request protocol, it transmits multiple messages between client and server to establish a connection. Clients connect to servers using TCP/IP, NetBEUI or IPX/SPX.
Once a connection is established, they can then send commands which allow acces to shares etc. Windows OS since Windows 95 includes support for SMB, Samba supports SMB on Unix systems.
Enum4Linux is a tool often used to enumerate SMB shares on Windows/Linux. This is installed by default on Parrot & Kali, or can be downloaded . The syntax is as follows:
Options that can be used are:
-U: get userlist -M: get machine list -N: get namelist dump -S: get sharelist -P: get password policy info -G: get group and member list -a: perform all of the above
Syntax for making connections to SMB is:
Telnet is an application protocol. Telnet is a remote connection tool which sends all messages in clear text, Telnet has now been replaced with SSH. Telnet connects to the server using the syntax:
Always remember to check for uncommon ports that Telnet may be running on.
FTP allows the remote transfer of files over network. Typically, FTP uses a command and a data channel. The command channel is for transmitting commands and the data channel is for transferring data. FTP operates using a client-server protocol. While the FTP session is open it may execute FTP commands on the server.
FTP server may support active, passive or both connections. In active FTP, the client opens a port and listens. The server is required to actively connect. In passive FTP, the server opens a port and passively listens, the client must connect to it.
Both command and data channels are unencrypted with default FTP, making it vulnerable to man-in-the-middle attacks.
Allows a system to share directories and files with others over a network. NFS allows access to remote files as if they were local, this is achieved by mounting the file system on a server.
The client will request to mount a directory from a remote host on a local directory the same way it does a physical device. The mount service then connects to the relevant mount daemon using RPC. The server will check if the user has correct permissions to mount the requested directory and return a file handled which identifies each file & directory on the server.
To access a file, an NFS, an RPC called is placed to NFSD (the NFS daemon) on the server. The call takes parameters such as:
The file handle
The name of the file to be accessed
The user's, user ID
The user's group ID
By default, NFS shares have root squashing enabled, this prevents anyone connecting from having root access to the NFS volume. Remote users are assigned the "nfsnobody" user. If this is turned off it can allow the creation of SUID bit files, allowing root access.
An SUID bit means a file or files can be run with the permissions of the file owner/group. The following command will set the SUID bit:
SMTP is used to handle the sending of emails. To support email services, a protocol pair is required, comprising of SMP & POP/IMAP. SMTP servers allow three basic functions:
Verifies who is sending emails via SMTP
Sends outgoing mail
If outgoing mail can't be delivered, returns it to sender
POP (Post Office Protocol) and IMAP (Internet Message Access Protocol) are protocols responsible for transfer of email between client and mail server. POP downloads the inbox from the mail server to the client, whereas IMAP synchronises the current inbox with new mail on the server, downloading anything new. This means that any changes made on one computer, over IMAP, will persist when the inbox is synchronised from another computer.
SMTP works as follows:
The mail user agent connects to your domain's SMTP server e.g. smtp.google.com. This begins the SMTP handshake, usually over port 25. Once this is established and validated, the session starts.
The process of sending can now begin, the client submits the sender and recipient email address, the body of the email and any attachments to the server.
The SMTP server checks if the sending and receiving domain names are the same.
The SMTP server of the sender connects to the recipients SMTP server, if this can't be accessed, the mail is put into an SMTP queue.
The receiving SMTP server verifies the incoming email by checking if the domain and user name have been recognised. The server then forwards the email to the POP or IMAP server.
The email appears in the recipients inbox.
Poorly configured SMTP servers can provide footholds into networks. The SMTP service has two internal commands that allow enumeration of users: VRFY (confirm names of valid users) and EXPN (shows address of user's aliases and lists of e-mail).
Relational Database Management System (RDBMS) based on Structured Query Language (SQL).
A database is a persistent, organised collection of structured data. RDBMS is a software used to create and manage databases on a relational model. Every table relates to another tables "primary key" or other "key factors". MySQL is a brand name for a popular RDBMS software implementation. Other products also exist like PostgreSQL and MicrosoftSQL, this signifies their use of SQL.
MySQL is made up of the server and utility programs that help administer MySQL databases. The server handles all database instructions like creating, editing and accessing data. The process can be broken down into:
MySQL creates a database for storing and manipulating data, defining the relationship of each table.
Clients make requests using specific statements in SQL.
The server responds with the requested information.
MySQL runs on platforms like Linux and Windows. It is commonly the backend database for websites and forms an essential component of the LAMP stack: Linux, Apache, MySQL and PHP.