> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/enumeration/smb.md). # SMB #### SMB * SMB is a Windows implementation of a file share. And there's SIFs, which is the common internet file system, which is the generic term for it. * SMB stands for **Server Message Block.** SMB Connection: * Open File Explorer, right-click on Network -> Map Network Drive. * type **"\\\\\"** or **"\\\\\\Folder-name"** and click on browse, select a remote folder -> Finish ``` net use Z: \\\Folder-name$ /user: ``` SMB disconnection: * In powershell, type the below command to disconnect following SMB drives. ``` net use * /delete ``` SMB: Nmap Scripts: * Basically shows version ``` nmap -p445 --script smb-protocols ``` * 192.111.50.2Security Mode ``` nmap -p445 --script smb-security-mode ``` > " Auditing, vulnerability scans and pentests are useful to point out things that people miss that are default but dangerous. " * Enumerate Sessions ``` nmap -p445 --script smb-enum-sessions ``` ``` nmap -p445 --script smb-enum-sessions --script-args smbusername=,smbpassword=

``` * enumerate shares ``` nmap -p445 --script smb-enum-shares ``` ``` nmap -p445 --script smb-enum-shares --script-args smbusername=,smbpassword=

``` *Note: IPC sessions is a null session, not only we can get in as a guest but also can utilize this null session IPC.* * Enumerate users ``` nmap -p445 --script smb-enum-users --script-args smbusername=,smbpassword=

``` * Server stats ``` nmap -p445 --scripts smb-server-stats --script-args smbusername=,smbpassword=

``` * enumerate domains ``` nmap -p445 --sc192.111.50.2ripts smb-enum-domains --script-args smbusername=,smbpassword=

``` * enumerate groups ``` nmap -p445 --scripts smb-enum-groups --script-args smbusername=,smbpassword=

``` * enumerate services ``` nmap -p445 --scripts smb-enum-services --script-args smbusername=,smbpassword=

``` * enumerate shares and List directories ``` nmap -p445 --scripts smb-enum-shares,smb-ls --script-args smbusername=,smbpassword=

``` **SMBMap** SMBMap is a program written in Python, which can be used to connect, enumerate, upload and download files with some authentication. Can be used when SMBv1 is vulnerable ``` smbmap -u guest -p "" -d . -H ``` * executing command using SMBmap ``` smbmap -H -u -p -x 'command' ``` * list out the contents after viewing the shares drives ``` smbmap -H -u -p -L ``` * To list the file present in the share drive ``` smbmap -H -u -p -r '$' ``` * To upload a file from attack machine to victim/target machine ``` smbmap -H -u -p --upload 'Attacker_PATH' 'Target_PATH' ``` * To Download a file from target/victim machine to attacker machine ``` smbmap -H -u -p --download 'File_PATH_Target' ``` **SMB: Samba 1** ``` nmap -sU --top-port 25 --open ``` ``` nmap -p445 --script smb-os-discovery ``` **Metasploit Frame work** * its' actually a whole bunch of tools > /auxiliary/scanner/smb/smb\_version **NMB Lookup** ``` nmblookup -A ``` **SMB client** * to check null session ``` smbclient -L -N ``` **RPC client** * to connect with a null ``` rpcclient -U "" -N ``` **SMB: Samba 2** ``` rpcclient -U "" -N ``` rpcclient commands * to get OS information samba > srvinfo **enum4linux** * for OS information ``` enum4linux -o ``` ``` smbclient -L -N ``` ``` nmap -p445 --script smb-protocols ``` ``` msfconsole > use axiliary/scanner/smb/smb2 > set Rhosts > run ```

nmap <IP> -p445 --script smb-enum-users

``` msfconsole -q > user axiliary/scanner/smb/smb_enumusers > set rhosts > run ``` ``` enum4linux -U ``` ``` rpcclient -U "" -N > enumdomusers > lookupnames admin ``` **SMB: Samba 3** ``` nmap -p445 --script smb-enum-shares ``` ``` msfconsole -q > use auxiliary/scanner/smb/smb_enumshares > set rhosts exploit ``` ``` enum4linux -S ``` ``` smbclient -L -N ``` ``` enum4linux -G ``` ``` rpcclient -U "" -N > enumdomgroups ``` ``` enum4linux -i ``` ``` smbclient ///Public -N > help > cd secret > ls > cat flag > get flag ``` **SMB Dictionary Attack** When we do need to authenticate and we don't have credentials then we need to use dictionary attack ``` msfconsole -q > use auxiliary/scanner/smb/smb_login > set pass_file /usr/share/wordlists/metasploit/unix_passwords.txt > set smbuser jane > show options > exploit ``` **hydra** gzip -d /usr/share/wordlists/rockyou.txt.gz ``` hydra -l admin -P /usr/share/wordlists/rockyou.txt smb ``` ``` smbmap -H -u admin -p password1 ``` ``` smbclient -L -U jane ``` ``` smbclient ///jane -U jane > help > ls > cat flag ``` ``` smbclient ///admin -U admiin > ls > cd hidden > get flag.tar.gz > gzip 0d flag.tar.gz or > tar -xvf flag.tar.gz ``` ``` msfconsole -q > use auxiliary/scanner/smb/pip_auditor > set smbuser admin > set smbpass password1 > set rhosts > exploit ``` ``` enum4linux -r -u "admin" -p "password1" ```