Skip to content

04. Scanning targets

Jump to bottom
Jean MARSAULT edited this page Dec 27, 2017 · 14 revisions

Table of contents

Scanners

A scanner is generic term use to designate a process that will connect on the targets to:

  • Collect data
  • Hunt for IOC

There are currently several types of scanners:

  • IOC scanner
  • Hash scanner
  • Yara scanner (WIP)

Given an IOC file, a scanner will not process all the IndicatorItems elements, mostly separating hash-related data from the rest. The motivation behind this is that collecting hashes on the disk takes way much longer than collecting all the other categories of elements combined. Therefore, in order to scan your targets fully, they need to be scanned by both an IOC scanner and a hash scanner.

Scanning prerequisites

In order to launch a scan against a target, you need to:

  • Be able to reach the target on port 445: file exchange, service setup and command execution relies on the SMB protocol;
  • Be able to login under an local or domain account with local administration rights;
  • Check that the default administrative shares (C$, ADMIN$) are enabled: the Server service must be started;
  • Check that the account you are using has the right to open a session on the host from the network.

Launching a scan

The following command will allow you to launch a scanner instance, optionally specifying the batch name you want to restrict your search to:

Windows:

Scripts\activate.bat
python main.py run -c iocscan [-b <batch_name>]
python main.py run -c hashscan [-b <batch_name>]

Linux:

. ./bin/activate
python main.py run -c iocscan [-b <batch_name>]
python main.py run -c hashscan [-b <batch_name>]

Note: multiple scanners instances of any type can be run simultaneously.

Interpreting connection errors

If a host cannot be joined (SMB port closed, host down, non-existent IP address), a result will be created with the success variable set to False. After retries_left_* tries, it will be marked as *scanned and will not be scanned again by this kind of scanner.

If an error occurs during the setup/unsetup of the connection, no result is created, and both priority and number of tries left are decreased by one. You will not be able to view this host in the visualization result since no full scan happened on a scannable host.

CME: Common Mistake Enumeration

No writable share found amongst ...

CERTitude relies on a local or domain account with local administration rights. These rights are used to:

  • Connect with SMB
  • Drop a file in an administrative share
  • Register an executable as a service and launch it

The following misconfigurations can affect the administrator status:

  • Using a local account and having the value forceguest in HKLM\SYSTEM\ControlSet001\Control\Lsa set to 1: this prevents local accounts from establishing a correct SMB connection to the target.
  • Using a local account and having no value LocalAccountTokenFilterPolicy in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System or its value set to 0: this prevents local accounts different from the default Administrator account from exercing full elevated administrator rights
  • Using the default Administrator account and having the FilterAdministratorToken value in HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System set to 1: same as above for the default administrator account

File ...\RemComSvc.exe not found

The old version of the RemCom Service (similar to PsExec's PSEXESVC) used in CERTitude was starting to be flagged by antivirus software as a Remote Access Trojan (RAT). If this error message is printed, your antivirus may have removed your version of the file.

Please clone the latest version of the repo to get rid of this error.

SMBError - ErrNoMem

Description: This error can be encountered on Windows 7 (and maybe other) workstations. It is due to a lack of resources that can be allowed to the named pipes by the "LanManServer" service.

Fix: Add or modify the DWORD registry key in HKLM\SYSTEM\CurrentControlSet\services\LanManServer\Parameters named size to 0x3.

Admin command:

reg add HKLM\SYSTEM\CurrentControlSet\services\LanManServer\Parameters /t REG_DWORD /v Size /d 0x3 /f

Copyright © Wavestone 2017

Clone this wiki locally