2

I am working on an assignment where we are supposed to attack a private network simulated by a virtual machine provided to us using Kali. My Kali VM and the target network are on a 'host-only' private network in virtual box.

I scan the network using nmap and there is only a single other IP active so this leads me to the conclusion that the private netwwork is behind a router using NAT. Our task is:

"Using network scanners, extract the topology information of the company's private network. Identify available hosts, and for each host, find the IP address, Operating System, running services and open ports. Ensure that you specify the exact versions."

From what I can guess I am required to scan through the NAT to find details on the internal network but I can't seem to grasp how to do that.

The access point of the network has the following services available. enter image description here

Edit

To elaborate.The VM is supposed to emulate a companies private network. Its up and running and I can see the above services using nmap. I do know that I can use the browser to go to the IP of it (192.168.56.2) which displays a website (I'm guessing via one of the available apache services). I can browse around the website and gain information on employees and their positions in the company so I have been running brute force attacks on the SSH and FTP service based off of usernames I have guessed and put into a list. I have run Ncrack and hydra on both my generated username list and generic ones for days with no results on SSH and FTP. The website gave me some email accounts as well but running Hydra on SMTP gives my a 'Auth not activated' so I'm guessing that's not possible. I'm still running more permutations of usernames via NCrack and hydra to gain access but I'm not having any luck.

Edit 2 For additional info I did a nessus scan. Here is the link to the report.

|improve this question
  • 1
    Can you please elaborate more ? You said that the targeted network and your attacking machine are on the same "host-only- network, so you should already know the other machines. Unless you're connected to some VPN (OSCP lab ?) – HSN Feb 26 '16 at 19:28
  • Try this script -- github.com/milo2012/metasploitHelper – atdre Feb 26 '16 at 19:59
  • Maybe the private network in on another interface of the initial machine that you can access. Compromise that and then you can use it to pivot onto the private network. – SilverlightFox Feb 27 '16 at 13:28
2

I can not say how exactly you can solve you're problem. But to collect information with kali, you can use 2 Types of tools scanner and sniffer. Until now it seems you only used Nmap(scanner)

Here a list of other tools.

Portscanner & Co.

  • Nmap(most common)
  • Lanspy
  • Essentiel NetTools
  • Winfingerprint
  • Xprobe2
  • p0f

Sniffer

  • dsniff-Suite(dsniff,mailsnarf,urlsnarf,arpspoof)
  • PHoss
  • Driftnet
  • Ettercap
  • tcpdump
  • Wireshark(most common)

I would give you the advice to use Wiresahrk or the dsniff-suite. Both of them are very powerful. The Difficulty is to filter the information , that you get only usefull information.

Look for steer-codes and headers

If normal methods are not working try:

  • ARP-Spoofing
  • MAC-flooding.
|improve this answer
  • Since it is a VM and there aren't actually people on this private network I figured that it wouldn't have any traffic unless its a response to something I do. Can that still be used? – Nick Feb 26 '16 at 19:41
  • That depends if the system ont vm is online or if its offline? Basicelly a system which is online . Creates also traffic but less than if it's used. En example : The computer is still checking for updates an other stuff. – Mario di Feb 26 '16 at 19:53
  • Then I doubt it as this is on a 'host-only' network. – Nick Feb 26 '16 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.