Reconnaissance on rchitect

Port 139,445 SMB enumeration

Mon, 20 Jun 2022 00:00:00 +0000

SMB enumeration Link to heading

SMB is application layer protocol. This protocol is used for communication between PCs in same network. SMB mainly used for file transfer.

Here we are going to explian the enumeration techniques can be used for SMB protocol. Firat the below scan confirm the nmap ports are open in a server or not.

sudo nmap -sS -p- -Pn -T4 --min-rate 10000 -oN alltcp.txt 10.10.11.101
[sudo] password for rocky: 
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2022-06-10 19:46 EDT
Nmap scan report for 10.10.11.101
Host is up (0.048s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds

Once we see 139,445 ( smb related ports) are open lets try to enumerate more at smb level.

Nmap timers

Wed, 30 Mar 2022 00:00:00 +0000

What are max retries and min-rate in nmap Link to heading

Max-retries Link to heading

Its mainly used for troubleshooting purpose to confirm the ports open.

Higher the number it will provide accurate results. Lower the number the scan complete fast. If you you put max-retries as 0 it just scan single time and stops.

Command:

nmap -Pn --max-retries 0 -p 80 10.10.10.43

If you are looking for some specific ports, you can try this simple script:

IPSEC enumeration using Strongswan

Tue, 08 Mar 2022 00:00:00 +0000

VPN(IKE) enumeration Link to heading

isakmp service( port-500 related to ipsec VPN) only opened on server.There are some inbuilt scanners in Kali linux to enumerate IPSEC VPN

$ ike-scan -M 10.10.10.116 
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.10.116 Main Mode Handshake returned
 HDR=(CKY-R=8ec1706b5f6632a8)
 SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
 VID=1e2b516905991c7d7c96fcbfb587e46100000009 (Windows-8)
 VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T)
 VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n)
 VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation)
 VID=fb1de3cdf341b7ea16b7e5be0855f120 (MS-Negotiation Discovery Capable)
 VID=e3a5966a76379fe707228231e5ce8652 (IKE CGA version 1)

Ending ike-scan 1.9.4: 1 hosts scanned in 0.325 seconds (3.08 hosts/sec). 1 returned handshake; 0 returned notify

The tunnel uses IKE-V1 as per above results.To confirm its not running on IKE-V2

Port 161,162 SNMP enumeration

Sun, 27 Feb 2022 00:00:00 +0000

SNMP enumeration of port udp ports 161-162 Link to heading

Initial Scan

sudo nmap -sU --open -p 161 10.10.10.116 -oG out.txt\$ cat out.txt 
# Nmap 7.91 scan initiated Sun Mar 6 18:06:39 2022 as: nmap -sU --open -p 161 -oG out.txt 10.10.10.116
Host: 10.10.10.116 () Status: Up
Host: 10.10.10.116 () Ports: 161/open|filtered/udp//snmp///
# Nmap done at Sun Mar 6 18:06:40 2022 -- 1 IP address (1 host up) scanned in 1.04 seconds

Some Basic SNMP enumeration commands