*The start-up of the scenario lab takes a while, so you can start it from the bottom of the page now and read the module in the meantime.*

## Initial mapping of network hosts and ports with Nmap, RPC and SMB

Start by scanning the network with nmap. You can use the following options, for example:

- **-O**: Attempt to identify the operating system
- **-sS**: Use SYN scanning
- **-sV**: Try to identify network services
- **10.0.0.0/24**: Company network IP range (addresses 10.0.0.0-10.0.0.255).

```
sudo nmap -O -sS -sV 10.0.0.0/24
```

![](sanity:image-ebad2b229c9c39ae33c38fdc5e1fc3a0876b3d85-1610x478-png)

In addition, perform a lightweight UDP scan but for the sake of time, only target port 137. In a real client case, you would allocate time, get comfortable, and scan all ports.

```
sudo nmap -sU -sV -p137 10.0.0.0/24
```

![](sanity:image-1ff2f6552dd7a33ff4fd6cc7a4f97e0d67453401-1448x346-png)

---

## Notes with CherryTree

Your Kali Linux workstation has a program called CherryTree installed. You can use it for taking notes during the scenario. Open CherryTree, create a new node called "Enumeration" and inside it, create a new node called "Nmap" and copy-paste the results of Nmap from the terminal to the node.

![](sanity:image-470fdfaad893a9d4617c3e8277b28c4d76289c07-1036x488-png)

![](sanity:image-6a92e43d6f3538812793093e38dcd60e62da553b-872x286-png)

![](sanity:image-7f8e57d5dfa09b8374822e28f92c7a7a7503d92a-1030x386-png)

![](sanity:image-7a3db6c46ea86270e0cc459d5c7d8d8d96e5c824-880x314-png)

![](sanity:image-e626945864d6076cd01a542d8ccd92cd76275d0a-1308x804-png)

---

## Decoding Nmap results

The results reveal two interesting targets, 10.0.0.2 (dc1.evilcorp.local) and 10.0.0.3 (iis.evilcorp.local).

DC1 is clearly a domain controller and IIS1 is a web server.

On the DC1 server, several ports typical for the Windows environment are open. In this scenario, the following are relevant:

---

## 135/tcp, 593/tcp: epmapper

### MS-RPC

MSRPC (Microsoft Remote Procedure Call) is a protocol developed by Microsoft that enables communication between applications on different computers.

For example, a Windows server could offer a TCP port at 49502 called "Remote Procedure Call" (RPC), which could have a name like "Addition", and then it could be used by connecting to the port and calling a function that is then executed on that server.

### Epmapper

RPC typically uses such "dynamic" (varying) ports in the range of 49152-65535 to provide remote procedure calls. In order for the party using the service to know when a specific service is available from where, a type of directory is needed where one can ask "which port might this AddTogether service be found?".

And this service is about gates 135 and 593. Epmapper (MS-RPC EndPoint Mapper) is a network service that listens on TCP gates 135 and 593. The difference is that gate 593 provides the protocol over HTTP. The protocol is the same.

![](sanity:image-e744a3a4c0e8818e29c0f191fc73371467ea5228-1000x1000-png)

Eli epmapper works as a resolver for MSRPC services. This means that when an application wants to connect to an MSRPC service, it sends a query to the RPC endpoint mapper port. The RPC endpoint mapper port then responds to the query by indicating on which TCP port the respective MSRPC service is connected.

#### impacket-rpcdump

Your workstation contains a tool called "impacket-rpcdump" with which you can try to fetch RPC services listed by the epmapper from a Windows server.

![](sanity:image-2a205604b7532def33b5d13c7b065489959caef5-972x574-png)

If you look at the same with Wireshark, you will notice TCP traffic to port 135, which Wireshark has identified as DCE/RPC Endpoint Mapper traffic.

![](sanity:image-0d57ca957bcb7d33f589970ea3d4b9e0d43ecc45-1820x704-png)

And the answer:

![](sanity:image-04af8ffdd25140c77e66ff43db0987a4ed83099d-1380x508-png)

### RPC also works over SMB

The RPC service is not always found on a dynamic TCP port. The service can also be found behind a *named pipe* with which communication can be done using the SMB protocol, in which case ports 139 and 445 would be used.

---

## 139/tcp, 445/tcp: SMB

SMB (Server Message Block) is a protocol widely used in Windows environments, primarily used for three purposes:

- For sharing files
- For printer sharing
- Using pipes (IPC, Inter Process Communication) for inter-process communication.

SMB operates directly over TCP port 445.

The SMB protocol is also accessible from TCP port 139, where the protocol is served using NBT (NetBIOS over TCP/IP). NetBIOS is an old protocol that is available for SMB mainly for the purpose of supporting very old devices on the network, such as Windows XP machines, for example. However, it is enabled by default when SMB is also enabled.

---

## 137/udp, NetBIOS Name Service

NetBIOS name service is a protocol used for identifying computer network names. It is part of the older Windows network environment, but still enabled by default on newer Windows servers. The NetBIOS name service allows computers to be identified by their NetBIOS names, which can be up to 15 characters long.

#### nbtscan

The NetBIOS name service can also be used to investigate Windows networks. Your workstation has a tool called "nbtscan" that sends NetBIOS name queries to all the desired IP addresses and outputs the responses in a table.

![](sanity:image-4b9b6d9071f9171f9cdd5aa42c0a4407f9b21862-1304x276-png)

Again, if we look at it with Wireshark, we can see UDP traffic to port 137, which Wireshark correctly identifies as NetBIOS name service NBSTAT queries. NBSTAT sort of means "introduce yourself".

![](sanity:image-328f9c9aa4990a03233b255c1438afc309ac265e-2092x948-png)

![](sanity:image-36380a6eb54c2c3f60f99ee188ea0cb5b5e2ca74-2050x1388-png)

---

## 3389/tcp, RDP

TCP port 3389 on RDP (Remote Desktop) is the remote desktop protocol. We will connect to this port at the end of the course when we do hardening.

---

## 80/tcp, HTTP

Port 80 is typically used for HTTP service. In this case, nmap has identified an IIS (Internet Information Services) web server, which is Microsoft's HTTP server.

---

## Exercises

@exercise 3a65be88170d

---

## Lab

@exercise af75afdbdd39


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

Mapping the attack surface (Enumeration)

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

Mapping the attack surface (Enumeration)

Learn to hack — start here