Enumeration

CHALLENGE INFORMATION

	Platform: TryHackMe Path: Red Teaming Module: Post Compromise Room: Enumeration

DESCRIPTION:

This room is an introduction to enumeration when approaching an unknown corporate environment.

Introduction

This session focuses on post-exploitation enumeration, aimed at expanding access and gathering information after initial system entry. The goal is to use various tools and techniques to escalate privileges and gather data from compromised systems.

Assumptions

• Access to a system has already been gained, potentially with escalated privileges (e.g., admin or root access), providing a shell to the target.

PrivEsc Tools

• Scripts such as WinPEAS for Windows and LinPEAS for Linux facilitate privilege escalation.

Enumeration Techniques

• Focuses on collecting information such as user credentials, system configurations, and network details using common tools that appear benign.

Question 1: What command would you use to start the PowerShell interactive command line?

powershell.exe

Purpose

The session focuses on gathering extensive information from a compromised system using enumeration techniques. After gaining access to a shell, the goal is to expand knowledge beyond the initial entry point.

Initial Access and Shell

• Gaining access typically provides limited knowledge of the system, akin to navigating in a dark room.

Purpose of Enumeration

• To gather information crucial for further actions, such as accessing other network systems or exfiltrating data.

Data Collection Targets

• User identities: users, groups
• Network configurations: hostnames, routing tables, network shares, firewall configurations, SNMP and DNS details
• Services: network services, service settings, and audit configurations
• Applications: applications and banners
• Potential credentials: SSH keys, plain text passwords, credentials saved on web browsers or client applications

This process is integral to post-exploitation activities, enabling attackers to maximize access and loot from a compromised system.

Question 1: In SSH key-based authentication, which key does the client need?

private key

Linux Enumeration

System

Information about the distribution and release version:

ls /etc/*-release
cat /etc/os-release

System name and hostname:

hostname

Interesting files and directories:

cat /etc/passwd
cat /etc/group
# Contains the hashed passwords; requires root privileges
sudo cat /etc/shadow

# Mail directory
ls -lh /var/mail/

Applications:

# To find the installed applications
ls -lh /usr/bin/
# Or
ls -lh /sbin/

Packages:

# RPM-based Linux systems
# -qa: query all packages
rpm -qa

# Debian-based Linux systems
dpkg -l

Users

# Revealing usernames from /etc/passwd

# Who is logged in
# pts/<id> or 1 may indicate remote logon
# tty<id> may indicate direct logon
who

# Print your effective user ID
whoami

# Check who is logged in and what they are doing
w

# Get the real and effective user and group IDs
id

# Check the last logons: who, when, and for how long
last

# Check the allowed commands for the invoking user on the current system
sudo -l

Networking

# Check the IP address
ip address show
# Or
ip a s
# Or simply
ip a

# DNS servers
cat /etc/resolv.conf

Port Scan versus Netstat

One might think that using Nmap before gaining access to the target machine would provide a comparable result. However, this is not entirely true.

Nmap generates a relatively large number of packets to check for open ports, which can trigger intrusion detection and prevention systems. Furthermore, firewalls along the route can drop certain packets and hinder the scan, resulting in incomplete Nmap results.

NETSTAT

• To learn about network connections, routing tables, and interface statistics.
• Note: to obtain all the information, you need to run it as root.

# -a : show both listening and non-listening sockets
# -l : show only listening sockets
# -n : show numeric output instead of resolving the IP address and port number
# -t : TCP
# -u : UDP
# -x : UNIX
# -p : show the PID and name of the program to which the socket belongs

# Show programs listening on TCP sockets
netstat -plt
# To display all PIDs and program names
sudo netstat -plt

# Show all TCP and UDP listening and established connections and the program names with addresses and ports in numeric format
sudo netstat -atupn

Listing Open Files

LSOF – Run with root privileges for more detailed information about the processes.

# Display only internet and network connections
sudo lsof -i

# Filter for a specific port; here: SMTP port 25
sudo lsof -i :25

Running Services

PS – Report a snapshot of the current processes.

# -e : select all processes
# -f : full-format
# -l : long-format
# -j : jobs format
# -u : user-oriented format
# -a : select all processes (except session leaders and processes not associated with a terminal)
# -x : lift the BSD style "must have a tty" restriction

# List every process on the system in various formats
ps -e
ps -ef
ps -el

# Print a process tree; more visual
ps axjf
# Print all running processes
ps aux

# Filter output for a specific user
ps -ef | grep peter

Questions and Answers

SSH Credentials:

• Username: user
• Password: THM6877

Connect to the target box with SSH: ssh user@<targetbox-ip> and input the provided password when prompted.

Question 1: What is the name of the Linux distribution used in the VM?

Ubuntu

Check for NAME in the output.

cat /etc/*-release

Question 2: What is its version number?

20.04.4

Check for DISTRIB_DESCRIPTION in the output.

cat /etc/*-release

Question 3: What is the name of the user who last logged in to the system?

randa

Use the only entry besides your own and the user reboot.

last

Question 4: What is the highest listening TCP port number?

6667

Make sure to use -n to display the ports in numerical values.

netstat -ltn

Question 5: What is the program name of the service listening on it?

inspircd

You need elevated privileges for this. Use the same password that was provided before: THM6877.

sudo netstat -ltnp

Question 6: There is a script running in the background. Its name starts with THM. What is the name of the script?

THM-24765.sh

List all current processes and filter for the string ‘THM’.

ps aux | grep "THM"

Windows Enumeration

System

: Get detailed information about the system
: Build number and installed patches
systeminfo

: Check installed updates; can indicate how quickly systems are being patched and updated
wmic qfe get Caption,Description

: Check installed and started Windows services
net start

: Check installed applications only
wmic product get name,version,vendor

Users

: Check who you are logged in as
whoami
: Check your privileges
whoami /priv

: Check which groups you belong to
whoami /groups

: Check users on the system
net user

: Check groups on the system
: If the system is a Windows Domain Controller, use net group
net group
: If only a local machine, use net localgroup
net localgroup

: List users belonging to the local administrator's group
net localgroup administrators

: Check local settings on the machine
: Min/max password age/length, lockout policy, computer role, etc.
net accounts
: If the machine belongs to a domain
net accounts /domain

Networking

: Check the system's network configuration
ipconfig
: Check all network-related settings
ipconfig /all

Port Scan versus Netstat

You might think that you can get an identical result by port scanning the target system; however, this is inaccurate for two reasons.

A firewall might be blocking the scanning host from reaching specific network ports. Moreover, port scanning a system generates a considerable amount of traffic, unlike netstat, which makes zero noise.

NETSTAT – Network connections, routing tables, interface statistics, and more.

# -a : all listening ports
# -b : display binary involved in the connection
# -n : avoid resolving IP addresses
# -o : display process IDs (PID)

: All listening ports with involved binary and PID; do not resolve IPs
netstat -abno

ARP – Discover other systems on the local network.

# -a : show current ARP entries

: Check for systems on the same LAN
arp -a

Questions and Answers

SSH Credentials:

• Username: user
• Password: THM33$$88

Connect to the target box with SSH: ssh user@<targetbox-ip> and input the provided password when prompted.

Question 1: What is the full OS Name?

Microsoft Windows Server 2019 Datacenter

Use systeminfo and look for ‘OS Name’.

Question 2: What is the OS Version?

10.0.17763

Use systeminfo and look for ‘OS Version’.

Question 3: How many hotfixes are installed on this MS Windows Server?

30

Use systeminfo and look for ‘Hotfix(s)’.

Question 4: What is the lowest TCP port number listening on the system?

22

Use netstat and filter for TCP connections.

netstat -an -p tcp

Question 5: What is the name of the program listening on that port?

sshd.exe

Simply add the -b flag to the previous query.

netstat -anb -p tcp

DNS, SMB, and SNMP

DNS

• DNS zone transfer: Get a copy of all the records a DNS server is responsible for answering.
• Depending on the DNS server configuration, DNS zone transfer might be restricted.

# DNS zone transfer attempt

# -t AXFR: requesting a zone transfer
# @DNS_SERVER: the server we want to query regarding the records related to the specified DOMAIN_NAME
dig -t AXFR DOMAIN_NAME @DNS_SERVER
# Example
dig -t AXFR redteam.thm @<targetbox-ip>

SMB

: Check for shared folders
net share 

SNMP

• Simple Network Management Protocol (SNMP) was designed to help collect information about different devices on the network.
• It holds information about various network events.

SNMPCHECK

• A simple tool to query servers related to SNMP.
• snmpcheck (GUI) versus snmp-check (CLI)

# Example usage on the attack box; located at /opt/snmpcheck/
/opt/snmpcheck/snmpcheck.rb 10.10.121.106 -c COMMUNITY_STRING

# Install instructions
git clone https://gitlab.com/kalilinux/packages/snmpcheck.git
cd snmpcheck/
gem install snmp
chmod +x snmpcheck-1.9.rb

Questions and Answers

SSH Credentials:

• Username: user
• Password: THM33$$88

Connect to the target box with SSH: ssh user@<targetbox-ip> and input the provided password when prompted.

Question 1: Knowing that the domain name on the MS Windows Server of IP <targetbox-ip> is redteam.thm, use dig to carry out a domain transfer. What is the flag that you get in the records?

<redacted-flag>

Try carrying out a domain transfer (on your attack box). The flag can be found in the TXT records related to flag.redteam.thm.

dig -t AXFR redteam.thm @<targetbox-ip>

Question 2: What is the name of the share available over SMB protocol and starts with THM?

<redacted-flag>

Use net share on the target box to which you are connected via SSH. The share of interest maps to c:\users\user\private, and the Remark reads “Enjoy SMB shares”.

Question 3: Knowing that the community string used by the SNMP service is public, use snmpcheck to collect information about the MS Windows Server of IP <targetbox-ip>. What is the location specified?

<redacted-flag>

First, verify by scanning both the TCP and UDP ports related to SNMP. The TCP port appears to be filtered, while the UDP port is open.

user@kali:~$ nmap -sS -sU -p 161 10.10.121.106
...
PORT    STATE    SERVICE
161/tcp filtered snmp
161/udp open     snmp
...
user@kali:~$

Since TCP appears to be filtered, try disabling TCP enumeration (using the -d flag) in our first attempt. The flag appears right at the beginning in the System information section mapped to the Location record.

user@kali:~$ snmp-check -c public -d 
...
[+] Try to connect to 10.10.121.106:161 using SNMPv1 and community 'public'
[+] TCP connections enumeration disabled

[*] System information:
...
  Description                   : Hardware: AMD64 Family 23 Model 1 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 17763 Multiprocessor Free)
  Contact                       : TryHackMe
  Location                      : THM{<redacted-flag>}
...
user@kali:~$

More Tools for Windows

Sysinternals Suite

• Complete list of utilities
• A group of command-line and GUI utilities and tools
• Freely available
• Process Explorer: Shows the processes along with the open files and registry keys
• Process Monitor: Monitor the file system, processes, and registry
• PsList: Information about processes
• PsLoggedOn: Logged-in users

Process Hacker

• Efficient and reliable MS Windows GUI tool
• Information about running processes and related active network connections
• Information about system resource utilization (CPU, memory, disk, network)
• Freely available

GhostPack Seatbelt

• Part of the GhostPack collection
• Written in C#
• Not officially released in binary; you need to compile it yourself using MS Visual Studio

Question 1: What utility from Sysinternals Suite shows the logged-in users?

PsLoggedOn

Conclusion

Question 1: Congratulations on finishing this room. It is time to continue your journey with the next room in this module.

No answer needed