# Common Tools for Interacting with Serviceas
|**SMB**|**FTP**|**Email**|**Databases**|
|---|---|---|---|
|[smbclient](https://www.samba.org/samba/docs/current/man-html/smbclient.1.html)|[ftp](https://linux.die.net/man/1/ftp)|[Thunderbird](https://www.thunderbird.net/en-US/)|[mssql-cli](https://github.com/dbcli/mssql-cli)|
|[CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec)|[lftp](https://lftp.yar.ru/)|[Claws](https://www.claws-mail.org/)|[mycli](https://github.com/dbcli/mycli)|
|[SMBMap](https://github.com/ShawnDEvans/smbmap)|[ncftp](https://www.ncftp.com/)|[Geary](https://wiki.gnome.org/Apps/Geary)|[mssqlclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py)|
|[Impacket](https://github.com/SecureAuthCorp/impacket)|[filezilla](https://filezilla-project.org/)|[MailSpring](https://getmailspring.com/)|[dbeaver](https://github.com/dbeaver/dbeaver)|
|[psexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py)|[crossftp](http://www.crossftp.com/)|[mutt](http://www.mutt.org/)|[MySQL Workbench](https://dev.mysql.com/downloads/workbench/)|
|[smbexec.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py)||[mailutils](https://mailutils.org/)|[SQL Server Management Studio or SSMS](https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms)|
|||[sendEmail](https://github.com/mogaal/sendemail)||
|||[swaks](http://www.jetmore.org/john/code/swaks/)||
|||[sendmail](https://en.wikipedia.org/wiki/Sendmail)||
# File Sharing Services
- Internal examples: SMB, NFS, FTP, TFTP, SFTP
- Cloud examples: Dropbox, Google Drive, OneDrive, SharePoint, or other forms of file storage such as AWS S3, Azure Blob Storage, or Google Cloud Storage
## SMB
- In Windows, connect to an SMB share by pressing [Win] + [r] to open the run dialog box and type in path to share such as `\\192.168.1.2\Archive\`
- We may or may not be asked to authenticate with a subsequent pop-up
### cmd.exe
- From `cmd.exe`, we can interact with the share as follows:
```cmd
dir \\192.168.1.2\Archive\ #lists contents of share
net use n:\ \\192.168.1.2\Archive\ #attempts to map n:\ to the share
net use n:\ \\192.168.1.2\Archive\ /user:username <password> #attempts to map n:\ to the share with authentication
```
- With `n:\` mapped to the share, we can now interact with its contents as follows:
```cmd
dir n: /a-d /s /b | find /c ":\" #output is piped to a find command that counts how many files exist in the director
dir n:\*cred* /s /b
dir n:\*secret* /s /b
findstr /s /i cred n:\*.* # looks for lines within files that include the specified string
```
| **Syntax** | **Description** |
| ---------- | -------------------------------------------------------------- |
| `dir` | Application that lists a folder's contents |
| `n:` | Directory or drive to search |
| `/a-d` | `/a` is the attribute and `-d` means not directories |
| `/s` | Displays files in a specified directory and all subdirectories |
| `/b` | Uses bare format (no heading information or summary) |
| `/i` | case insensitve |
### PowerShell
- PowerShell can run both cmd commands and cmdlets
- From PowerShell, we can interact with the share as follows:
```powershell
Get-ChildItem \\192.168.1.2\Archive\ #lists contents of share like dir
New-PSDrive -Name "N" -Root "\\192.168.1.2\Archive" -PSProvider "FileSystem" #attempts to map n:\ to the share
```
- Attempting to map to a share with creds is a bit more complicated, we have to setup several local variable as follows:
```powershell
$username = 'plaintext'
$password = 'Password123'
$secpassword = ConvertTo-SecureString $password -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential $username, $secpassword
New-PSDrive -Name "N" -Root "\\192.168.220.129\Finance" -PSProvider "FileSystem" -Credential $cred
```
- With `n:\` mapped to the share, we can now interact with its contents as follows:
```powershell
PS C:\htb> N:
PS N:\> (Get-ChildItem -File -Recurse | Measure-Object).Count #counts number of items in n:\
PS C:\htb> Get-ChildItem -Recurse -Path N:\ -Include *cred* -File #searches for files with the "*cred* string"
PS C:\htb> Get-ChildItem -Recurse -Path N:\ | Select-String "cred" -List #looks for lines within files that include the specified string like findstr
```
### Linux
- First, we need to mount the smb share
```bash
sudo apt install cifs-utils
sudo mkdir /mnt/Finance
sudo mount -t cifs -o username=plaintext,password=Password123,domain=. //192.168.220.129/Finance /mnt/Finance
sudo mount -t cifs //192.168.220.129/Finance /mnt/Finance -o credentials=/path/credentialfile #alternative to the above with a cred file
```
- Credential file example
```text
username=plaintext
password=Password123
domain=.
```
- Once mounted, we can use typical Linux CLI tools like `find` and `grep` on the share
```bash
find /mnt/Finance/ -name *cred*
grep -rn /mnt/Finance/ -ie cred
```
# Email
- Two protocols are need to send an d receive messages
- SMTP for sending
- IMAP/POP3 for receiving
- A GUI mail client such as Evolution can be used to interect with an email server
- `sudo apt install -y evolution`
# Databases
- Two types: hierarchical dbs such as NoSQL; and SQL relational dbs
- Two most common SQL relational dbs: MySQL and MSSQL
## MSSQL
- While on Linux, use `sqsh` to interact with MSSQL
```bash
sqsh -S 10.129.20.13 -U username -P Password123
```
- While on Windows, use `sqlcmd` to interact with MSSQL
```cmd
sqlcmd -S 10.129.20.13 -U username -P Password123
```
- GUI app for interacting with MSSQL: SQL Server Mgmt Studio aka SSMS
- On Linux, we can use `dbeaver`, which is a GUI app that can interact with MSSQL
```bash
sudo dpkg -i dbeaver-<version>.deb
dbeaver &
```
## MySQL
- While on Linux, use `mysql` to interact with MySQL
```bash
mysql -u username -pPassword123 -h 10.129.20.13
```
- While on Windows, use `mysql.exe` to interact with MySQL
```cmd
mysql.exe -u username -pPassword123 -h 10.129.20.13
```