InfoSec LAB

Hetemit_Samba

Created: 4 min read

Samba

Nmap discovered a Samba server running on the target ports 139 and 445 The running service is Samba smbd 4.6.2

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hetemit]
└─$ nmap --script smb-enum-shares -sV -p139,445 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-04 18:14 CET
Nmap scan report for 192.168.218.117
Host is up (0.81s latency).
 
PORT    STATE SERVICE     VERSION
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.63 seconds

Share mapping failed likely due to lack of permissions

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hetemit]
└─$ enum4linux -a -r -o -n -A -U $IP       
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Feb  4 18:12:02 2025
 
 =========================================( Target Information )=========================================
 
Target ........... 192.168.218.117
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
 
 
 ==========================( Enumerating Workgroup/Domain on 192.168.218.117 )==========================
 
 
[E] Can't find workgroup/domain
 
 
 
 ==============================( Nbtstat Information for 192.168.218.117 )==============================
 
Looking up status of 192.168.218.117
No reply from 192.168.218.117
 
 ==================================( Session Check on 192.168.218.117 )==================================
 
 
[+] Server 192.168.218.117 allows sessions using username '', password ''
 
 
 ===============================( Getting domain SID for 192.168.218.117 )===============================
 
Domain Name: SAMBA
Domain Sid: (NULL SID)
 
[+] Can't determine if host is part of domain or part of a workgroup
 
 
 =================================( OS information on 192.168.218.117 )=================================
 
 
[E] Can't get OS info with smbclient
 
 
[+] Got OS info for 192.168.218.117 from srvinfo: 
	HETEMIT        Wk Sv PrQ Unx NT SNT Samba 4.11.2
	platform_id     :	500
	os version      :	6.1
	server type     :	0x809a03
 
 
 ======================================( Users on 192.168.218.117 )======================================
 
Use of uninitialized value $users in print at ./enum4linux.pl line 972.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 975.
 
Use of uninitialized value $users in print at ./enum4linux.pl line 986.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 988.
 
 ================================( Share Enumeration on 192.168.218.117 )================================
 
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
 
	Sharename       Type      Comment
	---------       ----      -------
	print$          Disk      Printer Drivers
	Cmeeks          Disk      cmeeks Files
	IPC$            IPC       IPC Service (Samba 4.11.2)
Reconnecting with SMB1 for workgroup listing.
Protocol negotiation to server 192.168.218.117 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
 
[+] Attempting to map shares on 192.168.218.117
 
//192.168.218.117/print$	Mapping: DENIED Listing: N/A Writing: N/A
testing write access Cmeeks
//192.168.218.117/Cmeeks	Mapping: OK Listing: DENIED Writing: DENIED
 
[E] Can't understand response:
 
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
//192.168.218.117/IPC$	Mapping: N/A Listing: N/A Writing: N/A
 
 ==========================( Password Policy Information for 192.168.218.117 )==========================
 
 
 
[+] Attaching to 192.168.218.117 using a NULL share
 
[+] Trying protocol 139/SMB...
 
[+] Found domain(s):
 
	[+] HETEMIT
	[+] Builtin
 
[+] Password Info for Domain: HETEMIT
 
	[+] Minimum password length: 5
	[+] Password history length: None
	[+] Maximum password age: 37 days 6 hours 21 minutes 
	[+] Password Complexity Flags: 000000
 
		[+] Domain Refuse Password Change: 0
		[+] Domain Password Store Cleartext: 0
		[+] Domain Password Lockout Admins: 0
		[+] Domain Password No Clear Change: 0
		[+] Domain Password No Anon Change: 0
		[+] Domain Password Complex: 0
 
	[+] Minimum password age: None
	[+] Reset Account Lockout Counter: 30 minutes 
	[+] Locked Account Duration: 30 minutes 
	[+] Account Lockout Threshold: None
	[+] Forced Log off Time: 37 days 6 hours 21 minutes 
 
 
 
[+] Retieved partial password policy with rpcclient:
 
 
Password Complexity: Disabled
Minimum Password Length: 5
 
 
 =====================================( Groups on 192.168.218.117 )=====================================
 
 
[+] Getting builtin groups:
 
 
[+]  Getting builtin group memberships:
 
 
[+]  Getting local groups:
 
 
[+]  Getting local group memberships:
 
 
[+]  Getting domain groups:
 
 
[+]  Getting domain group memberships:
 
 
 =================( Users on 192.168.218.117 via RID cycling (RIDS: 500-550,1000-1050) )=================
 
 
[I] Found new SID: 
S-1-22-1
 
[I] Found new SID: 
S-1-5-32
 
[I] Found new SID: 
S-1-5-32
 
[I] Found new SID: 
S-1-5-32
 
[I] Found new SID: 
S-1-5-32
 
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
 
S-1-22-1-1000 Unix User\cmeeks (Local User)
 
[+] Enumerating users using SID S-1-5-21-3325954428-699464429-3406591564 and logon username '', password ''
 
S-1-5-21-3325954428-699464429-3406591564-501 HETEMIT\nobody (Local User)
S-1-5-21-3325954428-699464429-3406591564-513 HETEMIT\None (Domain Group)
 
[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
 
S-1-5-32-544 BUILTIN\Administrators (Local Group)
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)
 
 ==============================( Getting printer info for 192.168.218.117 )==============================
 
No printers returned.
 
 
enum4linux complete on Tue Feb  4 18:14:03 2025

Found the followings:

  • a valid system user; cmeeks
  • a none default share; Cmeeks
    • no read/write access

Same results with nxc

Null Session

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hetemit]
└─$ smbclient //$IP/Cmeeks                                           
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \> put test 
NT_STATUS_ACCESS_DENIED opening remote file \test

Anonymous login is allowed yet no read/write access

Interactive Graph View

Backlinks