cyber-exploiting-smb-vulnerabilities-with-metasploit

name	cyber-exploiting-smb-vulnerabilities-with-metasploit
description	Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	true
origin_frontmatter	name: exploiting-smb-vulnerabilities-with-metasploit | description: 'Identifies and exploits SMB protocol vulnerabilities using Metasploit | Framework during authorized penetration tests to demonstrate risks from unpatched | Windows systems, misconfigured shares, and weak authentication in enterprise networks. | | ' | domain: cybersecurity | subdomain: network-security | tags: | - network-security | - smb | - metasploit | - exploitation | - eternalblue | version: '1.0' | author: mahipal |
hide	true

AUTHORIZED-LAB ONLY. Offensive/dual-use capability. Use exclusively against systems you own or have explicit written authorization to test. This skill is gated out of the default discovery path; activation requires an explicit authorized-engagement flag.

Exploiting SMB Vulnerabilities with Metasploit

When to Use

• Testing Windows systems for critical SMB vulnerabilities (EternalBlue, EternalRomance, PrintNightmare) during authorized penetration tests
• Demonstrating lateral movement risks via SMB relay, pass-the-hash, and credential spraying
• Validating that patch management processes have addressed known SMB vulnerabilities
• Assessing SMB signing enforcement and share permission configurations across the domain
• Testing network segmentation by attempting SMB exploitation across VLAN boundaries

Do not use against systems without explicit written authorization, against production domain controllers without a maintenance window, or to deploy persistent backdoors beyond the scope of the assessment.

Prerequisites

• Metasploit Framework 6.x installed (msfconsole --version)
• Authorized penetration test scope document listing target IP ranges and approved attack types
• Network access to target SMB services (TCP 445, TCP 139)
• CrackMapExec and Impacket tools installed for complementary SMB testing
• Valid test credentials or credential wordlists approved for the engagement
• Kali Linux or equivalent testing platform

Workflow

Step 1: Enumerate SMB Services and Versions

# Discover hosts with SMB open using Nmap
nmap -sS -p 445,139 --open -oA smb_hosts 10.10.0.0/24

# Enumerate SMB versions and OS information
nmap -sV -p 445 --script smb-os-discovery,smb-protocols -oA smb_enum 10.10.0.0/24

# Use CrackMapExec for rapid SMB enumeration
crackmapexec smb 10.10.0.0/24 --gen-relay-list smb_nosigning.txt

# Check SMB signing status (disabled = vulnerable to relay)
crackmapexec smb 10.10.0.0/24 --smb-signing

# Enumerate shares with null session
crackmapexec smb 10.10.0.0/24 -u '' -p '' --shares

Step 2: Scan for Known SMB Vulnerabilities

# Start Metasploit and scan for MS17-010 (EternalBlue)
msfconsole -q
msf6> use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(smb_ms17_010)>  RHOSTS file:smb_hosts.txt
msf6 auxiliary(smb_ms17_010)>  THREADS 10
msf6 auxiliary(smb_ms17_010)> run


msf6> use auxiliary/scanner/smb/ms08_067_check
msf6 auxiliary(ms08_067_check)>  RHOSTS file:smb_hosts.txt
msf6 auxiliary(ms08_067_check)> run


nmap -p 445 --script smb-vuln-cve-2020-0796 10.10.0.0/24


crackmapexec smb 10.10.0.0/24 -u testuser -p  -M printnightmare