09 / RECONNAISSANCE
Network Enumeration & Host Discovery Lab
Hands-on reconnaissance against intentionally vulnerable Metasploitable2 target using Kali Linux tools—Nmap service scanning, enum4linux SMB enumeration, and SNMP information leakage exploitation.
Lab overview
Practical network reconnaissance exercise demonstrating systematic information gathering against a live vulnerable target. Techniques span network-layer discovery, service enumeration, protocol-level exploitation, and credential cracking.
Environment setup
- Attacker: Kali Linux 2024.1 (192.168.56.104) with full offensive toolkit suite.
- Target: Metasploitable2 (192.168.56.107)—deliberately vulnerable Linux with outdated services and default credentials.
- Network: VirtualBox Host-only segment for isolated testing without affecting production systems.
Enumeration phases
1. Network Scan (Nmap)
- Identified 22 open ports including SSH, Telnet, SMTP, HTTP, SMB, MySQL, VNC, and proprietary services.
- Service version detection revealed outdated packages vulnerable to known CVEs (e.g., Apache 2.2.8, OpenSSH 4.7).
- OS fingerprinting confirmed Linux kernel and distribution via TTL, response signatures, and open port patterns.
2. SMB/NetBIOS Enumeration (enum4linux)
- Extracted NetBIOS shares and workgroups without authentication.
- Dumped user accounts and SID history via LSA queryPolicy.
- Identified share permissions (readable user home directories, writeable tmp shares).
- Recovered password policy: minimum length 5 characters, no complexity requirement—enabling weak credential attacks.
3. SNMP Information Leakage (snmpwalk)
- Enumerated system description OID and discovered hostname, kernel version, and uptime.
- Harvested installed software inventory via Windows processes OID (cross-referenced with service enumeration).
- Extracted running services and network interface configuration.
- Retrieved local user accounts and group memberships through SNMP community strings (default public/private accessible).
Attack surface analysis
- Weak Authentication: Telnet (cleartext), default credentials (msfadmin/msfadmin), guest SMB access.
- Known Vulnerabilities: Apache mod_ssl DoS, OpenSSH integer overflow, Samba arbitrary code execution.
- Information Disclosure: Unfiltered SNMP, exposed services, verbose error messages, backup files in web root.
- Privilege Escalation: Kernel exploits, SUID binary misconfigurations, cron job exploitation.
Findings and remediation
Quick wins: Disable unnecessary services, enforce strong passwords, restrict SMB/SNMP to trusted networks, apply OS patches.
Defensive strategy: Network segmentation, service hardening, intrusion detection tuning, privilege access management, regular vulnerability assessments.
Lab scope: This assessment was conducted against intentionally vulnerable systems in an isolated lab environment for coursework and training purposes only.
Tools reference
- Nmap: nmap -sV -sC -O -p- --script smb-* target
- enum4linux: enum4linux -a -M target
- snmpwalk: snmpwalk -v2c -c public target 1.3.6.1.4.1.77.1.2.25
- Supporting tools: Hashcat (password cracking), tcpdump (traffic analysis), Metasploit (exploit validation).