# Null Session Attacks

### Null Session Attack Tools

```markdown
[1] enum4linux
[2] smbclient
[3] winfo
[4] enum
[5] NET USE
```

#### **Enumeration** using `enum4linux`

`enum4linux -a <IP-Address>`

`enum4linux -n <IP-Address>`

**Notations**

```markdown
-a ==> Do all simple enumeration
-n ==> Do an nmblookup (similar to nbtstat)
```

#### **Enumeration and Exploitation Using `smbclient`**

<mark style="color:green;">**Share Enumeration can be performed using tools provided by**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`Samba Suitesmbclient`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**is an**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`FTP`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**like client to access**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`Windows shares`**</mark><mark style="color:green;">**; this tool can, among other things, enumerate the shares provided by a host**</mark>

**Command Example**

`smbclient -L //10.130.40.80 -N`

**Checking for Null Sessions with Linux**

<mark style="color:blue;">**We can also perform the very same checks by using**</mark> `smbclient`:

`smbclient //10.130.40.80/IPC$ -N`

`smbclient //10.130.40.80/C$ -N`

`smbclient \\\\\\\\192.168.99.162\\\\WorkSharing -N`

**useful `smbclient` commands**

`smbclient -L WORKGROUP -I 192.168.99.162 -N -U ""`

#### **Exploiting Null Sessions with `winfo`**

<mark style="color:green;">**Winfo is another command line utility we can use to automate null session exploitation. To use it, you just need to specify the target IP address and use the -n command line switch to tell the tool to use null sessions.**</mark>

**`winfo` is available in `packetstorm`**

**Basic Command Syntax**

**`winfo <ip-address> -n`**

**Notation**

```markdown
-n ==> Null Sessions
```

#### **Exploiting Null Sessions with `enum`**

**\*\* Please Note \*\* It will note administrative shares too.`enum` is available in `packetstorm`**

**`enum -S <ip-address>`**

**`enum -U <ip-address>`**

**`enum -P <ip-address>`**

**Notations**

```markdown
-S ==> Enumerate the Shares of a Machine
-U ==> Enumerate the Users of a Machine
-P ==> Let us see the Password Policy if wwe want to mount the network [Authentication Attacks]
```

#### **Enumerate Using `nmblookup`**

<mark style="color:green;">**To perform the same operations of**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`nbstat`**</mark><mark style="color:green;">**, we can use**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`nmblookup`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**with the same command line switch:**</mark>

**Command Syntax**

**`nmblookup -A <target-IP-Address>`**

#### **Enumerate using `NET VIEW`**

<mark style="color:green;">**Once an attacker knows that a machine has File Server service running, they can enumerate the shares by using the**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**`NET VIEW`**</mark><mark style="color:green;">**&#x20;**</mark><mark style="color:green;">**command**</mark>

**Command Syntax**

**`NET VIEW <target-IP>`**

#### <mark style="color:red;">**Checking Null Sessions with Windows**</mark>

<mark style="color:red;">**To connect, we have to type the following command in a Windows shell:**</mark>

**`NET USE \\\\<target-IP-address>\\IPC$ '' /u:''`**

<mark style="color:blue;">**This tells Windows to connect to the IPC$ share by using an empty password and an empty username!**</mark>
