임시

A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.

Overview:

Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from www.bindview.com.

It is written in Perl and is basically a wrapper around the Samba tools smbclient, rpclient, net and nmblookup.

The tool usage can be found below followed by examples, previous versions of the tool can be found at the bottom of the page.

Key features:

RID cycling (When RestrictAnonymous is set to 1 on Windows 2000)

User listing (When RestrictAnonymous is set to 0 on Windows 2000)

Listing of group membership information

Share enumeration

Detecting if host is in a workgroup or a domain

Identifying the remote operating system

Password policy retrieval (using polenum)

#enum4linux -v target-ip

자세히 모드

#enum4linux -a target-ip

target에 대해 모든 옵션 실행(apart from dictionary based share name guessing)

#enum4linux -U target-ip

username list 출력

#enum4linux -u administrator -p password -U target-ip

username, password 명시

#enum4linux -r target-ip

RID 사이클을 통해 user 나열

#enum4linux -R 500-550 target-ip

RID범위를 지정하여 실행

#enum4linux -G target-ip

그룹과 멤버리스트 출력

#enum4linux -S target-ip

sharelist 출력

#enum4linux -s <share_file> target-ip

share_file을 가지고 무차별 대입 실시

#enum4linux -o target-ip

os정보 출력

등등

It’s a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc.

Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module.

It’s written in perl programming language and can be run either under *NIX or Windows platforms. It’s the first Mexican tool included in BackTrack Linux (BT4 R2).

Fuzzing modules supported in this version:

HTTP

HTTP URL

FTP

TFTP

Payload (Protocol independent)

STDOUT

./dotdotpwn.pl -m http -h 192.168.1.1 -x 8080 -f /etc/hosts -k "localhost" -d 8 -t 200 -s

-m(mode), -h(hostname), -x(port), -f(file), -k(text pattern), -d(depth of traversals), -t(request time), -s(service)

./dotdotpwn.pl -m http-url -u http://192.168.1.1:10000/unauthenticated/TRAVERSAL -O -k "root:" -r webmin.txt

-m(mode), -u(specified URL), -O(os), -k(text pattern), -r(report file name)

./dotdotpwn.pl -m ftp -h 192.168.1.1 -s -U nitr0us -P n1tr0u5pwnzj00 -o windows -q -r ftp_server.txt

-m(mode), -h(hostname), -s(sevice), -U(specified Username), -P(password), -o(known os), -q(quiet mode)

./dotdotpwn.pl -m tftp -h 192.168.1.1 -b -t 1 -f windows/system32/drivers/etc/hosts

-m(mode), -h(hostname), -b(취약점 발견시 종료), -t(request time), -f(file)

./dotdotpwn.pl -m payload -h 192.168.1.1 -x 10000 -p payload_sample_1.txt -k "root:" -f /etc/passwd

./dotdotpwn.pl -m stdout -d 5

The Traversal Engine will create fuzz pattern strings with 8 levels of deepness and DotDotPwn will 

print the results to STDOUT, so you can use it as you wish, by example, passing the traversal 

patterns as a parameter to another application, pipe, socket, etc.