Testing SMB/CIFS file-sharing services (TCP 445, and 139 over NetBIOS) on Windows and Samba hosts during authorized engagements. Covers share enumeration, null/guest session abuse, user and RID enumeration, credentialed access with netexec/crackmapexec, password spraying, command execution (psexec/wmiexec/smbexec/atexec), SAM/LSA dumping, and notable CVEs such as EternalBlue (MS17-010).
Instrucciones de origen · Vista previa de solo lectura
name
pentesting-smb
description
Testing SMB/CIFS file-sharing services (TCP 445, and 139 over NetBIOS) on Windows and Samba hosts during authorized engagements. Covers share enumeration, null/guest session abuse, user and RID enumeration, credentialed access with netexec/crackmapexec, password spraying, command execution (psexec/wmiexec/smbexec/atexec), SAM/LSA dumping, and notable CVEs such as EternalBlue (MS17-010).
During authorized internal network or Active Directory penetration tests when TCP 445 or 139 is open
When you need to enumerate shares, users, groups, and the domain password policy
When testing for anonymous/null sessions, guest access, and default credentials
When you have credentials (or NT hashes) and want to access shares, dump secrets, or move laterally
When assessing Samba servers on Linux/Unix for dangerous smb.conf misconfigurations
Quick Enumeration
# Version and vuln scan (also fingerprints OS)
nmap --script "safe or smb-enum-*" -p 445 <IP>
nmap --script smb-os-discovery,smb-security-mode,smb2-security-mode -p 445 <IP>
nmap --script smb-vuln-ms17-010 -p 445 <IP> # EternalBlue check# Full enumeration via null/anon IPC$ session
enum4linux -a <IP>
enum4linux-ng -A [-u "<username>" -p "<passwd>"] <IP>
# netexec / crackmapexec (the modern workhorse)
netexec smb <IP> # banner, signing, domain, OS
crackmapexec smb <IP> -u '' -p '' --shares # null session shares
crackmapexec smb <IP> -u 'guest' -p '' --shares # guest session shares# rpcclient null session
rpcclient -U "" -N <IP>
Critical: Checks Most Often Missed
Null / anonymous session on IPC$ — connect with empty user and password. Often still yields OS info, parent domain, users, groups, shares, and the password policy via enum4linux/enum4linux-ng.
Guest account access — guest with a blank password frequently lists shares even when null does not.
EternalBlue (MS17-010) — unpatched SMBv1 remote code execution. Confirm with nmap --script smb-vuln-ms17-010 or crackmapexec smb <IP> -M ms17-010. Do NOT run the exploit without explicit written authorization; the kernel pool overflow can crash the host.
Readable SYSVOL/NETLOGON — readable by all authenticated domain users. Hunt for Registry.xml (GPP autologon passwords), web.config, and logon scripts with embedded creds. Also test write access even on "read-only"-looking shares (NTFS ACLs may allow writes → logon-script poisoning).
NTFS vs share ACL mismatch — a share that looks read-only may still allow file writes. Always test by uploading a small file.
How to CONFIRM: a null session is confirmed when smbclient -U '%' -N \\\\<IP>\\IPC$ -c '' returns no error, or crackmapexec smb <IP> -u '' -p '' --shares lists shares. Treat NT_STATUS_ACCESS_DENIED as "share exists, no access" and NT_STATUS_BAD_NETWORK_NAME as "share does not exist."
Automated discovery of sensitive files and share ACLs across the domain
Common Scenarios
Scenario 1: Anonymous Enumeration
A host allows null sessions. enum4linux-ng -A <IP> reveals the domain name, full user list, group memberships, and password policy — providing a user list for targeted password spraying.
Scenario 2: GPP Password in SYSVOL
A domain user can read \\<dc>\SYSVOL\<domain>\Policies\...\Registry.xml containing an autologon password configured via Group Policy, granting workstation access.
Scenario 3: Pass-the-Hash Lateral Movement
A dumped local Administrator NT hash is reused across the subnet. crackmapexec smb <subnet> -u Administrator -H <hash> flags hosts as Pwn3d!, and wmiexec.py -hashes :<hash> Administrator@<IP> yields a shell.
Scenario 4: EternalBlue Target
nmap --script smb-vuln-ms17-010 flags an unpatched server. With written authorization, the host is exploited for SYSTEM-level RCE; otherwise it is reported as a critical finding only.
