> For the complete documentation index, see [llms.txt](https://meowsec.gitbook.io/w1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://meowsec.gitbook.io/w1/tryhackme/thmw/network-services-2.md).

# Network services 2

Enumerating and Exploiting More Common Network Services & Misconfigurations

This room from [tryHackMe](https://tryhackme.com/room/networkservices2) describes a few more common Network Service vulnerabilities and misconfigurations. 

### Task 2: Understanding NFS

NFS -

* NFS = Network File System
* It is used to share file and directories using network
* Working method: client will request to mount directory. If client has permission, it will send 'file handle'

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbC2_3onjcvS7irfJ1g%2F-MbC6zv8K0Ul-FAKrwHG%2Ft2.png?alt=media\&token=4c791e4b-5aea-45dc-b05f-280fa091e73e)

### Task 3: Enumerating NFS

Method for enum - 

* Scan with nmap
* Create mount point (directory) in the attacker machine
* Command to connect with mount:  **`mount -t nfs IP:share /tmp/mount/ -nolock`**
  * **mount**: Execute the mount command
  * **-t nfs**: type of device to mount. Here it is nfs
  * **IP:share** : the ip of the target and the share we want to mount
  * **-nolock**: not to use NLM locking

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbC2_3onjcvS7irfJ1g%2F-MbC6cAXZc6HJzdOOCSP%2Ft3.png?alt=media\&token=ec72eaae-e7b7-42f4-9327-b5686b639e0e)

### Task 4: Exploiting NFS

NFS pentest cheat sheet: [hackTricks](https://book.hacktricks.xyz/pentesting/nfs-service-pentesting)

Example method for exploiting - 

* Get NFS access
* Gain low privilege access
* Upload bash executable to NFS share
* Get a reverse shell / Enumerate for ssh key / Escalate privilege

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbC76TTdfejHnhx0DAL%2F-MbC8HmwvKVA0AqCQdXe%2Fimage.png?alt=media\&token=d5faf17f-fa33-4ce3-8dab-e546e90fe291)

### Task 5: Understanding SMTP

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbC8k9-TNPFs76GB_T8%2F-MbC9tl_6bQJYNdWbmvF%2Fimg043.gif?alt=media\&token=fbac7312-b1af-496c-89b2-17df068f8007)

SMTP -

* Stands for - simple mail transfer protocol
* It's verifies and sends outgoing mail
* Works with POP/IMAP
  * POP (post office protocol) : simply downloads the inbox from mail server
  * IMAP (internet message access protocol) : this is to synchronize the current inbox

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbCAmwPMEJZGVKdQyBy%2F-MbCAyu4hxIY87PWG8eH%2Fimage.png?alt=media\&token=2dbcc146-b833-4e40-b024-632045815d97)

### Task 6: Enumerating SMTP

Two internal commands for SMTP -

* VRFY: confirm the name of valid users
* EXPN: this reveals the actual address of user and list of email

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbClsBd7Huna5wxoGVx%2F-MbCpT2W9OUKW9OGu0dN%2Ft4.png?alt=media\&token=df4f9293-d292-4c31-af06-785b6d6afd1f)

### Task 7: Exploiting SMTP

Hydra brute force gave the solution here: **`hydra -t 16 -l [USERNAME] -P [rockyou.txt location] -vV [Machine IP Addres] ssh`**

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbClsBd7Huna5wxoGVx%2F-MbCqhkboJOEi5_-U9BA%2Fimage.png?alt=media\&token=35045ab3-09db-465c-a195-798549abbc18)

### Task 8: Understanding MySQL

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbClsBd7Huna5wxoGVx%2F-MbCsEBgOZMpYDfwWTk-%2Fimage.png?alt=media\&token=318d27d1-0e30-44eb-aadf-9ede9a247d06)

### Task 9: Enumerating MySQL

MySQL is not going to initial attack point. After getting initial access, it will help.

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbCsLz6qEEoUtESmj39%2F-MbCu__ouDWuPvpG5zFn%2Fimage.png?alt=media\&token=b7cd7a39-b33a-49dd-a334-66a2c6160911)

### Task 10: Exploiting MySQL

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbCsLz6qEEoUtESmj39%2F-MbCx5a17PuWWIWijKMl%2Ftt.png?alt=media\&token=084e16e3-897c-4088-a2e8-b65d3ba91267)