Ethical Hacking

Module IV

Enumeration

EC-Council

Module Objective

Understanding Windows 2000 enumeration

How to Connect via Null Session

How to disguise NetBIOS Enumeration

Disguise using SNMP enumeration

How to steal Windows 2000 DNS information using zone transfers

Learn to enumerate users via CIFS/SMB

Active Directory enumerations

EC-Council

What is Enumeration

If acquisition and non intrusive probing have not turned up any results, then an attacker will next turn to identifying valid user accounts or poorly protected resource shares.

Enumeration involves active connections to systems and directed queries.

The type of information enumerated by intruders:• Network resources and shares

• Users and groups

• Applications and banners

EC-Council

Net Bios Null Sessions

The null session is often refereed to as the Holy Grail of Windows hacking. Null Sessions take advantage of flaws in the CIFS/SMB (Common Internet File System/ Server Messaging Block).

You can establish a Null Session with a Windows (NT/2000/XP) host by logging on with a null user name and password.

Using these null connections allows you to gather the following information from the host:• List of users and groups

• List of machines

• List of shares

• Users and host SIDs (Security Identifiers)

EC-Council

So What's the Big Deal?

Anyone with a NetBIOS connection to your computer can easily get a full dump of all your usernames, groups, shares, permissions, policies, services and more using the Null user.The above syntax connects to the hidden Inter Process Communication 'share' (IPC$) at IP address 192.34.34.2 with the built- in anonymous user (/u:'''') with ('''') null password.

The attacker now has a channel over which to attempt various techniques.The CIFS/SMB and NetBIOS standards in Windows 2000 include APIs that return rich information about a machine via TCP port 139 - even to unauthenticated users.

C: \>net use \\192.34.34.2 \IPC$ '''' /u: '''‘

EC-Council

Null Session Countermeasure

Null sessions require access to TCP 139 and/ or TCP 445 ports.

You could also disable SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from the interface.

Edit the registry to restrict the anonymous user.• 1. Open regedt32, navigate to HKLM\SYSTEM\

CurrentControlSet\LSA

• 2. Choose edit | add value

• value name: ResticAnonymous

• Data Type: REG_WORD

• Value: 2

EC-Council

NetBIOS Enumeration

NBTscan is a program for scanning IP networks for NetBIOS name information. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.

The first thing a remote attacker will try on a Windows 2000 network is to get list of hosts attached to the wire.

1. net view / domain,

2. nbstat -A <some IP>

EC-Council

Hacking Tool: DumpSec

DumpSec reveals shares over a null session with the target computer.

EC-Council

Hacking Tool: NAT

The NetBIOS Auditing Tool (NAT) is designed to explore the NetBIOS file-sharing services offered by the target system.

It implements a stepwise approach to gather information and attempt to obtain file system-level access as though it were a legitimate local client.

If a NETBIOS session can be established at all via TCP port 139, the target is declared "vulnerable“.

Once the session is fully set up, transactions are performed to collect more information about the server including any file system "shares" it offers.

EC-Council

SNMP Enumeration

SNMP is simple. Managers send requests to agents, and the agents send back replies.

The requests and replies refer to variables accessible to agent software.

Managers can also send requests to set values for certain variables.

Traps let the manager know that something significant has happened at the agent's end of things:• a reboot• an interface failure, • or that something else that is potentially bad has

happened. Enumerating NT users via SNMP protocol is

easy using snmputil

EC-Council

SNMPutil example

EC-Council

Tool: IP Network Browser

EC-Council

SNMP Enumeration Countermeasures

Simplest way to prevent such activity is to remove

the SNMP agent or turn off the SNMP service.

If shutting off SNMP is not an option, then change

the default 'public' community name.

Implement the Group Policy security option called

Additional restrictions for anonymous connections.

Access to null session pipes and null session

shares, and IPSec filtering should also be

restricted.

EC-Council

Windows 2000 DNS Zone transfer

For clients to locate Win 2k domain services such as Ad and kerberos, Win 2k relies on DNS SRV records.

Simple zone transfer (nslookup, ls -d <domainname>) can enumerate lot of interesting network information.

An attacker would look at the following records closely:• 1. Global Catalog Service (_gc._tcp_)

• 2. Domain Controllers (_ldap._tcp)

• 3. Kerberos Authentication (_kerberos._tcp)

EC-Council

Blocking Win 2k DNS Zone transfer

You can easily block zone transfers using the DNS property sheet as shown here.

EC-Council

Identifying Accounts

Two powerful NT/2000 enumeration tools are: • 1.sid2user

• 2.user2sid They can be downloaded at

(www.chem.msu.su/^rudnyi/NT/) These are command line tools that look up NT SIDs from

username input and vice versa.

EC-Council

Hacking Tool: Enum

Available for download from

http://razor.bindview.com

enum is a console-based Win32 information

enumeration utility.

Using null sessions, enum can retrieve user lists,

machine lists, share lists, name lists, group and

membership lists, password and LSA policy

information.

enum is also capable of rudimentary brute force

dictionary attack on individual accounts.

EC-Council

Hacking tool: Userinfo

Userinfo is a little function that retrieves all available information about any known user from any NT/Win2k system that you can hit 139 on.

Specifically calling the NetUserGetInfo API call at Level 3, Userinfo returns standard info like• SID and Primary group

• logon restrictions and smart card requirements

• special group information

• pw expiration information and pw age

This application works as a null user, even if the RA set to 1 to specifically deny anonymous enumeration.

EC-Council

Hacking Tool: GetAcct

GetAcct sidesteps "RestrictAnonymous=1" and acquires account information on Windows NT/2000 machines.

Downloadable from (www.securityfriday.com)

EC-Council

Active Directory Enumeration

All the existing users and groups could be

enumerated with a simple LDAP query.

The only thing required to perform this

enumeration is to create an authenticated session

via LDAP.

Connect to any AD server using ldp.exe port 389

Authenticate yourself using Guest /pr any domain

account

Now all the users and built in groups could be

enumerated.

EC-Council

AD Enumeration countermeasures

How is this possible with a simple guest account?

The Win 2k dcpromo installations screen prompts

if the user wants to relax access permissions on

the directory to allow legacy servers to perform

lookup:

1.Permission compatible with pre-Win2k

2.Permission compatible with only with Win2k

Choose option 2 during AD installation.

EC-Council

Summary

Enumeration involves active connections to systems and directed queries.

The type of information enumerated by intruders includes network resources and shares, users and groups and applications and banners.

Null sessions are used often by crackers to connect to target systems.

NetBIOS and SNMP enumerations can be disguised using tools such as snmputil, nat etc.

Tools such as user2sid, sid2user and userinfo can be used to identify vulnerable user accounts.