I'm using Nmap for penetration testing for a while, and I need to know:

Assuming I obtained user credentials, is there any script that I can use, for searching what resources this user is able to access? e.g What places he's able to connect (RDP).

I used this script:smb-enum-shares.nse to reveal the shared folders he can access, but this can be done easily with other programs.

  • And for the RDP, from what I've seen, there's no way to map the credentials' available RDP targets except, examining a specific target manually, checking that port number 3389 is open and then trying to connect. – yuda41 Apr 16 '15 at 6:51

nmap is designed for service enumeration, and as a bonus, it has scripts that can dig a little deeper, but that's not really what it is intended for. If you have a user's creds, you need to switch to other tools to dive into that user's scope and reach.

  • Do You have any idea for such tools? – yuda41 Apr 26 '15 at 6:31

For the broadest coverage with the fewest arguments, use your credentials as input into Nmap's credential brute-forcing scripts. Any of the scripts that use the unpwdb library will read usernames and passwords from a common source, which you can specify on the command-line:

nmap --script brute --script-args "userdb=userfile,passdb=passfile"

If the userfile contains the username and the passfile contains the password, then the brute-forcing will just use the one combination and then end.

Use caution in selecting scripts, though; not all of the brute-category scripts use unpwdb library, so some of them may perform bruteforcing with other lists of usernames and passwords: Here's a list of them.

  • I like your solution, the only downside of the "Brute" scripts is that it does not appeal to RDP (Remote Desktop Protocol) – yuda41 Apr 14 '15 at 7:13
  • In addition, do you know what should be the file extention for those DB's? I created 2 .lst files containing the user name: domain\user and the password . e.g.nmap --script brute --script-args userdb=/home/myname/nmap_user.lst,passdb=/home/myname/nmap_pass.lst,unpwdb.userlimit=2,unpwdb.passlimit=2 but no result was given I'm wondering if it's because you have to give a specific file extension for the userdb and passdb OR because they should be on a different location>?? – yuda41 Apr 16 '15 at 6:47
  • @yuda41 no particular file extension is needed. But some versions had a bug where absolute paths could not be used. Try using -d to get debug output, and use relative paths. – bonsaiviking Apr 16 '15 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.