Let's get into some Metasploit enumeration now.
Now this is less of the automated side and more of the automated side, if you will.
I know that sounds weird, but what we were doing with the PowerShell scripts
was putting everything together to enumerate outside of through LDAP.
And we're doing the exact same thing here, except that this time
we're already in a meterpreter session on the actual system, the domain computer.
And Eric was unsuspecting of dummy.exe and ran it.
And like I said, that was the setup already.
And by doing this, we can kind of prepare for how we want to do Metasploit scripting
inside of our own terminal.
And we can set up automated tasks that Metasploit can run for us
whenever we connect to a particular system or a network whenever we're doing our pentest.
Now, that being said, we're already in our meterpreter session.
And I'm going to be going over four of the high value enumeration tools.
Now, are these the only ones out there? Absolutely not.
In fact, if you type in run post and I got to do it inside the terminal here.
Run post. And this is a Windows system that we're connected to Windows.
And then inside there, go gather.
And you can see that you have 177 possibilities and they all come up.
Now, there's a whole section here as we get down. There we go.
Here, and I'm going to zoom in for you because the section gets even longer,
that we have enum, which is short for enumerate,
which means that you can actually go in and do a little bit of enumeration.
And like, for instance, I'm just going to use this one real quick.
Enum, oh, I was just looking at it, domain users.
Okay, let me zoom back out and go back in there.
And now, so enum underscore domain users.
Invalid options, either host or user must be specified.
Ah, so we must have more information for that.
And that's okay, because what that means is that we actually have to go in on these,
because, you know, you can't just do a show options.
You're already inside the meterpreter.
You would just do a space and then host 192.168.0.49.
And then a user would be, we can say Eric.
Of course, it'd help if I get my syntax right,
but this one was attempted to identify Eric on 049, the domain controller.
Post aborted due to failure, no sessions found, so Eric has no sessions.
But that was not the one that we wanted to focus on.
You can see I messed up all the syntax right above.
We want to do a run post windows gather enum domain.
Now, this one is just going to tell us just the basic info,
but this basic info is really good to have,
because this tells us the fully qualified domain name,
along with the net bios name, basically the domain slash username here,
and then the actual domain controller, along with the IP address of it.
So you have the LDAP information right here to be able to call up the operator.
Pretty straightforward, straight to the point.
The next one that we're going to be doing is enum domain group users.
Yep, there we go.
And then for this one, it has a flag on it as well.
Codes are in the code box below.
And what I did was I was searching for domain administrators.
Now, you can see here that the output for this is a lot more cleaner
than what we were getting in our PowerShell script.
It shows you here that it is Texas administrator.
The difference between this and the script that we were using is
that in the script, we got the full on where it's at in Active Directory,
the container, the OU, et cetera.
The benefit here is that inside of Metasploit,
it actually has on that last line, user list,
root, ms4, loot, blah, blah, blah, blah.
So it's actually saving the output to a file,
so that way you don't have to go in and hand jam everything down.
You can actually just refer to it in that file.
Now, our next one is going to be enum patches.
And this one's pretty important because this will tell you about the actual
system that you're on.
And it will tell you the hot fixes that are installed.
So that way, based on that information,
you can see if there's a vulnerability that may not have been reported
inside of OpenVAS, but you know that if a hot fix has come out recently,
and you don't see it here,
then it could be susceptible to that vulnerability.
And this is just something to keep in mind, too,
that as you're pen testing those different organizations,
it'd be nice if you actually had a list of applicable patches that are,
you know, they should be at.
Now, every organization's going to have their own security policy and
exemptions.
That's something to keep in mind, too.
But this gives you a starting point.
And the last one that we're going to use for this one is one of my favorites
because this is a way to get around the noise level that is in map.
If you're already on a system inside the domain itself,
you could use an arm scanner.
We're going to use our host on this one of 192.168.0.0 slash 24.
Basically the subnet of this particular system that we're dummied into right
now.
And what this is doing is giving us an art table of systems that have
communicated either through broadcast or to that client system.
And it's also far less noisy than in map because in map,
even though you can scale it based on time,
since a lot of traffic because it's checking TCP ports,
UDP ports, if you have it configured like that,
and a lot of ICMP traffic.
Whereas this right here is just doing,
Hey,
layer one,
what's your address?
Nothing more than that.
It's not going up the OSI model enough to raise enough alarms to have
anybody come over and say,
Hey,
what's going on.
And as you can see here,
as I zoom in for you that we are getting IP addresses along with Mac
addresses of systems that are live within our organization's network.
If this does not come up on a map network map and it's approved with
inside of your scope.
Now you have a new target to play with.