SMB and SMTP Enumeration Using Different Tools

* Introduction to Enumeration

Enumeration is the process of collecting information about a target after discovering that it is reachable. It helps us learn more about the services, users, shares, and other information exposed by the target.

Enumeration is important in cybersecurity because attackers can use the collected information to understand the target and find possible attack paths. In this task, I used different tools to perform enumeration on SMB and SMTP services.

1. SMB Enumeration

1.1 SMB Enumeration Using Nmap

First, I used Nmap to enumerate the SMB service on the target. I used SMB enumeration scripts to look for available shared resources and users.

nmap -p 445 --script smb-enum-shares,smb-enum-users <TARGET_IP>

nmap -p 445 --script smb-enum-shares,smb-enum-users <TARGET_IP>

The scan returned information about the available SMB shares and the users found on the target.

1.2 SMB Enumeration Using smbclient

Next, I used smbclient to enumerate the SMB shares on the target.

smbclient -L //<TARGET_IP> -N

smbclient -L //<TARGET_IP> -N

The -L option lists the available shares, while -N allows an anonymous login without asking for a password.

The enumeration showed shared resources such as print$, tmp, opt, IPC$, and ADMIN$.

I then connected directly to the tmp share:

smbclient //<TARGET_IP>/tmp -N

smbclient //<TARGET_IP>/tmp -N

After connecting, I used:

ls

ls

to list the files inside the share. I also tested downloading a file using:

get .X0-lock

get .X0-lock

This showed that the tmp share allowed anonymous access and that files could be accessed from it.

2. SMTP Enumeration

2.1 SMTP Enumeration Using Nmap

After SMB, I moved to SMTP enumeration. I used Nmap to check the SMTP service on port 25 and to try to enumerate SMTP users.

nmap -p 25 --script smtp-enum-users <TARGET_IP>

nmap -p 25 --script smtp-enum-users <TARGET_IP>

The scan confirmed that port 25 was open and running SMTP. However, the RCPT method returned an unhandled status code, so the script did not return the usernames (this is un normal thing)

2.2 SMTP Enumeration Using smtp-user-enum

Next, I used smtp-user-enum with the VRFY method and a username wordlist.

smtp-user-enum -M VRFY -U /path/to/unix_users.txt -t <TARGET_IP>

smtp-user-enum -M VRFY -U /path/to/unix_users.txt -t <TARGET_IP>

The tool checks the SMTP server for valid users using the VRFY method. It can identify users that exist on the SMTP server.

2.3 SMTP Enumeration Using Netcat

I also used Netcat to connect directly to the SMTP service.

nc <TARGET_IP> 25

nc <TARGET_IP> 25

After connecting, the SMTP server returned its banner, which showed information about the server, such as Postfix and Ubuntu.

I then used the VRFY command to check a specific username:

VRFY <username>

VRFY <username>

The server returned a response that could be used to determine how the SMTP server handles user verification.

This showed how Netcat can be used to communicate directly with an SMTP service and manually test SMTP commands.

3. Metasploit Enumeration

3.1 Searching for SMB Modules

First, I opened Metasploit using:

msfconsole

msfconsole

Then I searched for available SMB modules:

search smb

search smb

The search smb command shows the available SMB modules in Metasploit.

3.2 SMB Version Enumeration

I selected the SMB version module:

use auxiliary/scanner/smb/smb_version

use auxiliary/scanner/smb/smb_version

Then I set the target IP:

set RHOSTS <TARGET_IP>

set RHOSTS <TARGET_IP>

Finally, I ran the module:

run

run

The module identified the SMB service as Samba 3.0.20-Debian running on a Unix-based system.

3.3 Searching for SMTP Modules

After SMB, I searched for SMTP modules:

search smtp

search smtp

This showed the available SMTP-related modules in Metasploit.

3.4 SMTP Version Enumeration

I selected the SMTP version module:

use auxiliary/scanner/smtp/smtp_version

use auxiliary/scanner/smtp/smtp_version

Then I set the target IP:

set RHOSTS <TARGET_IP>

set RHOSTS <TARGET_IP>

and ran the module:

run

run

The module identified the SMTP service running on port 25 as Postfix on Ubuntu. It also revealed the hostname metasploitable.localdomain.

4. Conclusion

Through this task, I used different tools to perform SMB and SMTP enumeration. I learned how Nmap, smbclient, smtp-user-enum, Netcat, and Metasploit can be used to collect information about services, shares, users, and server software.

This information can help attackers understand the target and find possible attack paths. It also shows why services should be properly configured and unnecessary information should not be exposed