<h1>Metasploitable 3 Ubuntu Walkthrough: Part V</h1>

Port 137 (UDP) – NetBIOS Name Service

The name service operates on UDP port 137. Usually, not exploitable but useful for enumeration purposes.

Enumerating NetBIOS with NBTScan

NBTScan is a command line tool used for scanning networks to obtain NetBIOS shares and name information. It can run on both Unix and Windows and ships with Kali Linux by default.

In this case, not a lot of information but always better than nothing.

Enumerating NetBIOS with Nmap

Nmap contains a script that we can also use to discover NetBIOS shares. This has the advantage that it can be ran with other NSE scripts, ultimately saving time when enumerating many different things on a network.

Enumerating NetBIOS with Metasploit

As expected, MSF has some modules to be used against NetBIOS. Only one currently produces useful info:

Port 139 – NetBIOS Session Service

Two applications start a NetBIOS session when one (the client) sends a command to “call” another client (the server) over TCP Port 139.

Enumerating NetBIOS with Nmap

Only a few Nmap scripts can be run against port 139 to produce some valid info. Try to check the correct service version with Nmap:

Not really satisfying, right? Two other scripts might reveal some info:

Messy… Imagine what might happen if you run only this script! That’s exactly why you should run multiple tools to double check the gathered info.

Exploiting Port 445 – SMB

This port is used for the Server Message Block sharing files between different operating system i.e. Windows-Windows, Unix-Unix and Unix-windows. One of the first things you can ty is to brute force your access.

Brute forcing SMB using Hydra

Create and use a custom list for users and passwords.

No luck? Something similar will happen with Metasploit and Nmap’s smb-brute script is not working anymore…

Several tools can be used to extract information from the target via the SMB service

Enumerating SMB using Nmap

Nmap has many NSE scripts that can be used against hosts where the SMB service is running, but not all of them return useful results:

Interesting information but it should always be confirmed using other tools and there are several other options available in Kali Linux to enumerate the SMB service.

Enumerating SMB using SMBClient

You can use a tool called smbclient to connect to the Metasploitable box, and list the available shares without having a valid username or password. Just hit enter when it asks for root’s password, and it will grant you anonymous access.

NOTE: In the current Kali version you will need to edit the /etc/samba/smb.conf to get the proper results.

Enumerating SMB using enum4linux

Very good information!

Enumerating SMB using RPCClient

Patiently and using several tools you will get a lot of useful information about your target. There are other tools available but, in this case, they return absolutely nothing.

Exploiting SMB using Metasploit

After the enumeration, and using the information retrieved, you can now get to exploit your target via the SMB.

You can create a meterpreter session by running a command on the remote machine using a previously opened session. As an example, I already have a session created via the ProFTPD exploit. Now, I will use the appropriate MSF module to create a payload a command to be executed on the remote machine. Once that is done, I move back to the command session and execute the command that will download the payload to the remote machine and it will execute it:

Unfortunately, the meterpreter session will retain the low privilege access.

NOTE: This exploit is not related to port 445 but illustrates what you can do when you can upload files and execute them on the remote machine.

Exploiting SMB manually

From the enumeration we know there is a SMB folder shared as public, mapped to /var/www/html and accessible by the chewbacca user. This will allow you to upload a web shell to gain access to the system.

The first thing to do is to generate a payload using MSFVenom:

Next, upload it through the Samba share:

Ok, so the payload file is now on the target’s filesystem. Those of you reading carefully and paying attention to the details should have noticed I cheated a bit here… Yeah, the SMB password for the Chewbacca user is not exactly the same as the previously discovered password for the same user.

You can find this password online or you can crack it but this latter option is outside the scope of this walkthrough series.

Now, time to prepare a listener to receive the incoming connection. Make sure you choose the same payload as the one used in MSFVenom.

Now browse to the target’s website and trigger the payload by clicking on it. You will immediately see a new session opening on your listener: