Internal Network Pentest and IR Reference: network discovery

# Network Discovery

## MAC Address

* [mac2vendor.com](https://mac2vendor.com/) - OUI Database Lookup
* [oui.is](https://oui.is/) - MAC Address Vendor Lookup

| MAC Prefix | Description           |
| ---------- | --------------------- |
| FC:D4:F2   | Coca Cola Company     |
| 00:9E:C8   | Xiaomi Communications |
| 08:9E:08   | Google                |

```ps1
sudo ifconfig <interface-name> down
sudo ifconfig <interface-name> hw ether <new-mac-address> 
sudo ifconfig <interface-name> up
```

## DHCP

DHCP (Dynamic Host Configuration Protocol) is a networking protocol used to automatically assign IP addresses and other network configuration parameters to devices on a network. DHCP allows devices to obtain necessary network configuration information from a DHCP server, rather than having to be manually configured.

```ps1
sudo nmap --script broadcast-dhcp-discover
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-04 11:15 CET
Pre-scan script results:
| broadcast-dhcp-discover: 
|   Response 1 of 1: 
|     Interface: eth0
|     IP Offered: 192.168.1.111
|     DHCP Message Type: DHCPOFFER
|     Server Identifier: 192.168.1.254
|     IP Address Lease Time: 1d00h00m00s
|     Renewal Time Value: 12h00m00s
|     Rebinding Time Value: 21h00m00s
|     Broadcast Address: 192.168.1.255
|     Hostname: Host-005
|     Domain Name Server: 192.168.1.254
|     Domain Name: lan
|     Router: 192.168.1.254
|_    Subnet Mask: 255.255.255.0
```

## DNS

* AD DNS
    * LDAP: `nslookup -type=srv _ldap._tcp.dc._msdcs.<domain name>`
    * KDC: `nslookup -type=srv _kerberos._tcp.<domain name>`
    * Global catalog: `nslookup -type=srv _ldap._tcp.<domain name>`

## NBT-NS

NS (Name Service) is a component of NBT that provides name resolution services for NETBIOS names. In the context of NBT, NS is responsible for mapping NETBIOS names to IP addresses.

NBT NS uses a distributed database to store NETBIOS name-to-IP address mappings. Each computer on the network is responsible for registering its own name and IP address in the database, and for resolving names to IP addresses when necessary. When a computer needs to resolve a NETBIOS name to an IP address, it sends a query to the NBT NS service on another computer on the network. The NBT NS service responds with the IP address associated with the requested name, if it is known. It works on `UDP, Port 137`.

* Get names:  `nbtscan -r 192.168.1.0/24`
* Get the name for a single IP: `nmblookup -A <IP>`

## MDNS

MDNS (Multicast Domain Name System) is a protocol used for zero-configuration networking, also known as "zeroconf". It allows devices on a local network to automatically discover each other and resolve hostnames to IP addresses without the need for a centralized DNS server.

MDNS works by using multicast addresses to send DNS queries and responses. When a device wants to resolve a hostname to an IP address, it sends a multicast DNS query to a special multicast address (224.0.0.251 for IPv4 and ff02::fb for IPv6). Any device on the network that is listening for multicast DNS queries and has a matching hostname will respond with its IP address.

```ps1
mdns-scan
```

## ARP

ARP (Address Resolution Protocol) is a networking protocol used to map IP addresses to MAC (Media Access Control) addresses on a local area network (LAN).

* ARP neighbors

    ```ps1
    :~$ ip neigh
    192.168.122.1 dev enp1s0 lladdr 52:54:00:ff:0a:2c STALE
    192.168.122.98 dev enp1s0 lladdr 52:54:00:ff:aa:bb STALE
    ```

* ARP scan with `nmap` - note, needs root privileges. Check what packets nmap is sending with `--packet-trace`

    ```ps1
    :~# nmap -sn -n 192.168.122.0/24 
    Starting Nmap 7.93 ( https://nmap.org )
    Nmap scan report for 192.168.122.1
    Host is up (0.00032s latency).
    MAC Address: 52:54:00:FF:0A:2C (QEMU virtual NIC)
    ```

* ARP scan with `arp-scan`

    ```ps1
    root@kali:~# arp-scan -l
    Interface: eth0, datalink type: EN10MB (Ethernet)
    Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
    172.16.193.1 00:50:56:c0:00:08 VMware, Inc.
    172.16.193.2 00:50:56:f1:18:a8 VMware, Inc.
    172.16.193.254 00:50:56:e5:7b:87 VMware, Inc.
    ```

* ARP spoof with `arpspoof`

    ```ps1
    arpspoof [-i interface] [-c own|host|both] [-t target] [-r] host
    arpspoof -i wlan0 -t 10.0.0.X 10.0.0.Y
    ```

* ARP spoof with `Bettercap`

    ```ps1
    sudo bettercap -iface wlan0
    net.probe on
    set arp.spoof.targets <target_IP>
    arp.spoof on
    net.sniff on
    ```

## Ping

* Ping sweep with `nmap`: no port scan, no DNS resolution

    ```powershell
    nmap -sn -n --disable-arp-ping 192.168.1.1-254 | grep -v "host down"
    -sn : Disable port scanning. Host discovery only.
    -n : Never do DNS resolution
    ```

## LDAP

* Null bind connection: `ldapsearch -x -h <ip> -s base`

## Port Scans and Enumeration

### Nmap

* Basic NMAP

```bash
sudo nmap -sSV -p- 192.168.0.1 -oA OUTPUTFILE -T4
sudo nmap -sSV -oA OUTPUTFILE -T4 -iL INPUTFILE.csv

• the flag -sSV defines the type of packet to send to the server and tells Nmap to try and determine any service on open ports
• the -p- tells Nmap to check all 65,535 ports (by default it will only check the most popular 1,000)
• 192.168.0.1 is the IP address to scan
• -oA OUTPUTFILE tells Nmap to output the findings in its three major formats at once using the filename "OUTPUTFILE"
• -iL INPUTFILE tells Nmap to use the provided file as inputs
```

* CTF NMAP

This configuration is enough to do a basic check for a CTF VM

```bash
nmap -sV -sC -oA ~/nmap-initial 192.168.1.1

-sV : Probe open ports to determine service/version info
-sC : to enable the script
-oA : to save the results

After this quick command you can add "-p-" to run a full scan while you work with the previous result
```

* Aggressive NMAP

```bash
nmap -A -T4 scanme.nmap.org
• -A: Enable OS detection, version detection, script scanning, and traceroute
• -T4: Defines the timing for the task (options are 0-5 and higher is faster)
```

* Using searchsploit to detect vulnerable services

```bash
nmap -p- -sV -oX a.xml IP_ADDRESS; searchsploit --nmap a.xml
```

* Generating nice scan report

```bash
nmap -sV IP_ADDRESS -oX scan.xml && xsltproc scan.xml -o "`date +%m%d%y`_report.html"
```

* NMAP Scripts

```bash
nmap -sC : equivalent to --script=default

nmap --script 'http-enum' -v web.xxxx.com -p80 -oN http-enum.nmap
PORT   STATE SERVICE
80/tcp open  http
| http-enum:
|   /phpmyadmin/: phpMyAdmin
|   /.git/HEAD: Git folder
|   /css/: Potentially interesting directory w/ listing on 'apache/2.4.10 (debian)'
|_  /image/: Potentially interesting directory w/ listing on 'apache/2.4.10 (debian)'

nmap --script smb-enum-users.nse -p 445 [target host]
Host script results:
| smb-enum-users:
|   METASPLOITABLE\backup (RID: 1068)
|     Full name:   backup
|     Flags:       Account disabled, Normal user account
|   METASPLOITABLE\bin (RID: 1004)
|     Full name:   bin
|     Flags:       Account d