Enumeration
Here is some docs here
DNS, SMB, and SNMP
DNS
We are all familiar with Domain Name System (DNS) queries where we can look up A, AAAA, CName, and TXT records, among others.
One easy way to try DNS zone transfer is via the dig
command. Depending on the DNS server configuration, DNS zone transfer might be restricted. If it is not restricted, it should be achievable using dig -t AXFR DOMAIN_NAME @DNS_SERVER
. The -t AXFR
indicates that we are requesting a zone transfer, while @
precedes the DNS_SERVER
that we want to query regarding the records related to the specified DOMAIN_NAME
.
SMB
Server Message Block (SMB) is a communication protocol that provides shared access to files and printers. We can check shared folders using net share
. Here is an example of the output. We can see that C:\Internal Files
is shared under the name Internal.
user@TryHackMe$ net share
Share name Resource Remark
-------------------------------------------------------------------------------
C$ C:\ Default share
IPC$ Remote IPC
ADMIN$ C:\Windows Remote Admin
Internal C:\Internal Files Internal Documents
Users C:\Users
The command completed successfully.
SNMP
Simple Network Management Protocol (SNMP) was designed to help collect information about different devices on the network. It lets you know about various network events, from a server with a faulty disk to a printer out of ink. Consequently, SNMP can hold a trove of information for the attacker. One simple tool to query servers related to SNMP is snmpcheck
. The syntax is quite simple:
/opt/snmpcheck/snmpcheck.rb 10.10.49.33 -c COMMUNITY_STRING
If you would like to install snmpcheck
on your local Linux box, consider the following commands.
git clone https://gitlab.com/kalilinux/packages/snmpcheck.git
cd snmpcheck/
gem install snmp
chmod +x snmpcheck-1.9.rb
More Tools for Windows
Sysinternals Suite
The Sysinternals Suite is a group of command-line and GUI utilities and tools that provides information about various aspects related to the Windows system. To give you an idea, we listed a few examples in the table below. | Utility Name | Description | | ------------ | ----------- | | Process Explorer | Shows the processes along with the open files and registry keys | | Process Monitor | Monitor the file system, processes, and Registry | | PsList | Provides information about processes | | PsLoggedOn | Shows the logged-in users |
Check Sysinternals Utilities Index for a complete list of the utilities.
Process Hacker
Another efficient and reliable MS Windows GUI tool that lets you gather information about running processes is Process Hacker. Process Hacker gives you detailed information regarding running processes and related active network connections; moreover, it gives you deep insight into system resource utilization from CPU and memory to disk and network.
GhostPack Seatbelt
Seatbelt, part of the GhostPack collection, is a tool written in C#. It is not officially released in binary form; therefore, you are expected to compile it yourself using MS Visual Studio.