Enumeration involves connecting to a system, so it takes port scanning to the next level. Since enumeration is a more intrusive part of testing, you must have the organization’s permission as an ethical hacker. You are attempting to retrieve information and gain access to servers by using the employee logon accounts. In this chapter, you will learn about enumeration techniques, how to establish a null session, and how to identify enumeration countermeasures. You will learn about important concepts involving active and passive enumeration.
- 1.
Explain enumeration techniques.
- 2.
Recognize how to establish a null session.
- 3.
Identify enumeration countermeasures.
- 4.
Perform active and passive enumeration.
Steps to Compromise a System
Enumeration is the first step in compromising a system. The attacker is actively connecting to the target to obtain information. From there, the attacker tries to identify the password. Once the attacker gains access to the system using an account, they try to get administrator privileges. The attacker installs applications that provide information about the target and hides them so that an administrator cannot identify them. The attacker erases any trace of the path they have used.
- 1.
Enumeration
- 2.
Password cracking
- 3.
Privilege escalation
- 4.
Trace holding
- 5.
File hiding
- 6.
Application execution
Enumeration
Enumeration is listed as step one in comprising a system and is a process that involves making active connections to the target. The type of enumerated information can be grouped into four categories: network resources and shares, users and groups, auditing settings, and application banners.
Null user
With a null session, no user and password credentials are given. It is an anonymous connection to the network share IPC$. To establish a null session, type the command-line command shown below in the command prompt. From a null session, attackers can call APIs and use Remote Procedure Calls to get information on passwords, users, and services. Countermeasures include using filter ports, disabling SMB services, inspecting HKLM, configuring security policies, and restricting remote access.
net use \192.168.1.101IPC$ "" /user:""
Starting with Windows Vista and Server 2008, null sessions are not available and cannot be enabled even by the administrator.
NetBIOS Basics
A NetBIOS name (https://searchnetworking.techtarget.com/definition/NetBIOS) can be 16 characters, 15 of which are for the computer name. The final character is reserved for a hexadecimal character that identifies the service running on the computer. NetBIOS is an API that resource-sharing protocols can access in order to refer to computers by name. Computer names are not routable.
- 1.
A Windows programming interface that enables computers to communicate over a local area network (LAN)
- 2.
Files and printers can be shared.
- 3.
Utilizes UDP ports 137 (server service), 138 (datagram service), and 139 (TCP) ports (session service)
- 4.
A 15-character limit applies to NetBIOS names, which are computer names assigned to a system.
- 5.
On a network , a NetBIOS name must be unique.
Command-Line Tools
netstat displays network connections, routing tables, and network protocol statistics.
nbstat is a diagnostic tool for NetBios and is used to troubleshoot NetBios name resolution problems.
SNMP Enumeration
Agents allocated to managed systems and network management stations
Process information acquired
A MIB is set up with the resources to be monitored.
The default community string comprises the characters PUBLIC.
The attacker seeks a target host with SNMP enabled and a default community string.
For enumeration, built-in SNMP objects will be visible.
Limit access to null session shares.
Delete the SNMP agent or turn the SNMP service off.
Alter the community string.
Enforce the group policy security option.
Discovering Hosts with Windows Command Line Tools
Commands Used During Task 2 to Enumerate Windows Hosts
Command | Result |
|---|---|
net view | Enumerates the machines within the same workgroup |
net view/domain | Enumerates all workgroups and domains |
net view/domain: workgroup | Enumerates the machine in the workgroup WORKGROUP |
net view/domain: XYZcompany | Enumerates the machines in the workgroup XYZcompany |
Discovering Hosts with Metasploit
Using Cain
Setting up a scan with Cain
Cain scan results
Summary
Enumeration is the part of the testing process that requires permission from the organization. In this chapter, you learned about specific enumeration techniques, how to establish a null session, and various enumeration countermeasures. You also learned the differences between active and passive enumeration.