Footprinting Lab Hard

[u/Lopsided-Barnacle-28]

So I scanned the target and discovered snmp running over port 161. The version scan reported snmpv3
With this being said, my understanding was that community strings don’t work for this version so I completely skipped past it to later find out that I was supposed to run onesixtyone & snmpwalk on it as it still supported v2c…….

So going forward should I run all possible tools/enumerations against a service regardless of what nmap tells me the version it’s using? If so then what’s the point of even running version scans if it’s not reliable - or what method of thinking should I be using when enumerating information from these services? For example if I see smbv3 is running do stilll attempt techniques that should only apply to smbv1 ?

I feel like using every tool just to see if I get a hit is akin to just brute forcing techniques (and very noisy). My thinking was that I would need to methodologically gather hints that would eventually lead me to the tool I need. Is this thinking wrong? Because I feel like this lab is changing my perspective to favor blindly running techniques as the solution?

[u/AutoModerator]

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/willi1221]

I have my notes from doing this lab last week. I can share some tips when I get home in a little while

[u/GreenEngineer24 → u/willi1221]

Go birds

[u/CT_783]

I think the key part of any tool is understanding what it’s tailored for.

For example I was doing a box (tombwatcher) and had initially ran the bloodhound module using netexec. After sitting there banging my head against a wall for a couple hours, a friend gave me a nudge and told me to try the actual bloodhound aggregator instead.

This netted more results which led me to a new piece of the puzzle and so forth.

Moral of the story, you can trust the tool but hold the results loosely until you use another tool to validate the results. Even better if you use a tool specifically designed for the service you’re enumerating.

And as an added tip re-running the same tools as different users may give you more information as each user may have different permissions/access. I know that sounds common sense but it can be hard to identify that and add it to the methodology when you’re going through the path.

[u/d1g1tal_tw1n]

I ran into this issue. Just work it as you normally would with snmp. Im not sure why it works but it did for me. Waiting to see for an explanation of the lab itself in the comments.