CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/documentation/modules/auxiliary/scanner/smb/pipe_auditor.md
Views: 1904

Description

The pipe_auditor scanner will determine what named pipes are available over SMB. In your information gathering stage, this can provide you with some insight as to some of the services that are running on the remote system.

Verification Steps

  1. Do: use auxiliary/scanner/smb/pipe_auditor

  2. Do: set RHOSTS [IP]

  3. Do: set THREADS [number of threads]

  4. Do: run

Scenarios

msf > use auxiliary/scanner/smb/pipe_auditor msf auxiliary(pipe_auditor) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads msf auxiliary(pipe_auditor) > set RHOSTS 192.168.1.150-160 RHOSTS => 192.168.1.150-160 msf auxiliary(pipe_auditor) > set THREADS 11 THREADS => 11 msf auxiliary(pipe_auditor) > run [*] 192.168.1.150 - Pipes: \browser [*] 192.168.1.160 - Pipes: \browser [*] Scanned 02 of 11 hosts (018% complete) [*] Scanned 10 of 11 hosts (090% complete) [*] Scanned 11 of 11 hosts (100% complete) [*] Auxiliary module execution completed

We can see that running the scanner "###uncredentialed" does not return a great deal of information. If, however, running a "###credentialed", you will find that the pipe_auditor scanner returns a great deal more information.

msf auxiliary(pipe_auditor) > set SMBPass s3cr3t SMBPass => s3cr3t msf auxiliary(pipe_auditor) > set SMBUser Administrator SMBUser => Administrator msf auxiliary(pipe_auditor) > run [*] 192.168.1.150 - Pipes: \netlogon, \lsarpc, \samr, \browser, \atsvc, \DAV RPC SERVICE, \epmapper, \eventlog, \InitShutdown, \keysvc, \lsass, \ntsvcs, \protected_storage, \scerpc, \srvsvc, \trkwks, \wkssvc [*] Scanned 02 of 11 hosts (018% complete) [*] 192.168.1.160 - Pipes: \netlogon, \lsarpc, \samr, \browser, \atsvc, \DAV RPC SERVICE, \epmapper, \eventlog, \InitShutdown, \keysvc, \lsass, \ntsvcs, \protected_storage, \router, \scerpc, \srvsvc, \trkwks, \wkssvc [*] Scanned 04 of 11 hosts (036% complete) [*] Scanned 08 of 11 hosts (072% complete) [*] Scanned 09 of 11 hosts (081% complete) [*] Scanned 11 of 11 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(pipe_auditor) >