pentesting-smb

name	pentesting-smb
description	Testing SMB/CIFS file-sharing services (TCP 445, and 139 over NetBIOS) on Windows and Samba hosts during authorized engagements. Covers share enumeration, null/guest session abuse, user and RID enumeration, credentialed access with netexec/crackmapexec, password spraying, command execution (psexec/wmiexec/smbexec/atexec), SAM/LSA dumping, and notable CVEs such as EternalBlue (MS17-010).
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","smb","cifs","active-directory","lateral-movement"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting SMB (port 445/139)

When to Use

• During authorized internal network or Active Directory penetration tests when TCP 445 or 139 is open
• When you need to enumerate shares, users, groups, and the domain password policy
• When testing for anonymous/null sessions, guest access, and default credentials
• When you have credentials (or NT hashes) and want to access shares, dump secrets, or move laterally
• When assessing Samba servers on Linux/Unix for dangerous smb.conf misconfigurations

Quick Enumeration

# Version and vuln scan (also fingerprints OS)
nmap --script "safe or smb-enum-*" -p 445 <IP>
nmap --script smb-os-discovery,smb-security-mode,smb2-security-mode -p 445 <IP>
nmap --script smb-vuln-ms17-010 -p 445 <IP>          # EternalBlue check

# Full enumeration via null/anon IPC$ session
enum4linux -a <IP>
enum4linux-ng -A [-u "<username>" -p "<passwd>"] <IP>

# netexec / crackmapexec (the modern workhorse)
netexec smb <IP>                                     # banner, signing, domain, OS
crackmapexec smb <IP> -u '' -p '' --shares           # null session shares
crackmapexec smb <IP> -u 'guest' -p '' --shares      # guest session shares

# rpcclient null session
rpcclient -U "" -N <IP>

Critical: Checks Most Often Missed

1. Null / anonymous session on IPC$ — connect with empty user and password. Often still yields OS info, parent domain, users, groups, shares, and the password policy via enum4linux/enum4linux-ng.
2. Guest account access — guest with a blank password frequently lists shares even when null does not.
3. SMB signing not required — enables SMB relay (NTLM relay) attacks. netexec smb <IP> reports signing:False.
4. EternalBlue (MS17-010) — unpatched SMBv1 remote code execution. Confirm with nmap --script smb-vuln-ms17-010 or crackmapexec smb <IP> -M ms17-010. Do NOT run the exploit without explicit written authorization; the kernel pool overflow can crash the host.