Enumeration Concepts, NetBIOS, SNMP and LDAP

What it is

Enumeration extracts detailed information from a live system by making active connections to its services. Where scanning shows that a port is open, enumeration asks the service what it knows.

Typical results are user names, group names, host names, shares, network resources, running services and device configuration. These details feed password attacks and targeted exploits.

How it works

Enumeration concepts

Enumeration is more intrusive than footprinting, because the attacker is logged in or connected to the service. Many techniques rely on default settings or anonymous access.

Common ports to know:

NetBIOS enumeration

NetBIOS gives Windows computers names on a local network, and lets them share files and printers. A NetBIOS name is up to 16 characters, where the last character is a suffix that shows the service type.

The Windows command nbtstat shows NetBIOS statistics and name tables. Its -a option queries a remote computer by name, -A queries by IP address, -c shows the local name cache and -n shows the local name table. Scripts in Nmap and tools such as NetBIOS Enumerator show names, shares and logged-in users.

Null sessions, an anonymous connection to a Windows share, were once a common way to list users and shares. Modern Windows restricts them, but the exam still describes the concept.

SNMP enumeration

The Simple Network Management Protocol manages network devices such as routers, switches and printers. A manager asks an agent on the device for data, and the agent can also send unsolicited traps.

SNMP version 1 and 2c send community strings in clear text. Version 3 adds authentication and encryption, with the levels noAuthNoPriv, authNoPriv and authPriv.

An attacker who guesses the community string can walk the MIB and read interface lists, routing tables, running processes, installed software and user accounts. Tools for this include snmpwalk, SnmpCheck and OpUtils.

LDAP enumeration

The Lightweight Directory Access Protocol queries and edits directory services such as Active Directory. Entries have attributes such as names, email addresses, groups and computer accounts.

Countermeasures for these three

• Disable NetBIOS over TCP/IP where it is not needed, and block ports 137 to 139 and 445 at the border.
• Restrict anonymous access and null sessions in the operating system settings.
• Use SNMP version 3, change default community strings, and block UDP 161 and 162 from outside.
• Require authenticated and encrypted LDAP binds, and restrict who can read directory attributes.
• Apply least privilege and monitor for large numbers of queries.

A worked example

A scan shows UDP 161 open on a switch. The tester tries the default community string "public", reads the interface table and the system description, and finds the device model and software version. The report recommends SNMP version 3, a custom string for any remaining version 2c use and an access list that allows only the management station.

How the exam asks about this

• "Which Windows command lists NetBIOS names of a remote host?" -> nbtstat (with -a or -A).
• "Which SNMP community string normally gives read-write access by default?" -> private.
• "Which port does LDAP use by default?" -> TCP 389.