~/knowledge-smb

SMB & NetBIOS

CPTS Notes2 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. SMB, CIFS, and Samba
  2. Dialects
  3. Transport and NetBIOS
  4. The IPC$ pipe and MS-RPC
  5. Signing

Background for the SMB cheatsheet. The protocol, so the enumeration and attacks make sense.

SMB, CIFS, and Samba

  • SMB is the Windows file-, printer-, and resource-sharing protocol.
  • CIFS is the old SMBv1 dialect. The two names get used as if they mean the same thing.
  • Samba is the Unix and Linux implementation of SMB, so Linux hosts can serve and mount SMB.

Dialects

Dialect Introduced with Note
SMBv1 (CIFS) Windows 2000 Legacy and dangerous. Carries EternalBlue.
SMBv2 Windows Vista / Server 2008 Signing, caching.
SMBv3 Windows 8 / Server 2012 Encryption. SMB 3.1.1 (Windows 10 / Server 2016) adds integrity checks.

The highest dialect a host offers hints at its OS.

Transport and NetBIOS

SMB runs two ways:

  • Direct over TCP 445. The modern path.
  • Over NetBIOS: TCP 139 for the session, UDP 137 and 138 for name and datagram service.

NetBIOS names hosts on a local network and groups them into workgroups. The name service (137) answers who-is-who queries, which is why nbstat and enum4linux can pull host and domain names.

The IPC$ pipe and MS-RPC

IPC$ is a hidden share that carries named pipes rather than files. SMB enumeration tools reach MS-RPC interfaces through it: samr for users and groups, lsarpc for policy and SIDs, srvsvc for shares. A null session is an unauthenticated connection to IPC$, which is how anonymous user and share enumeration works when the server allows it.

Signing

SMB signing stamps each message so a man in the middle cannot alter it. When a server advertises signing as enabled but not required, an attacker can relay a captured authentication to it (NTLM relay). Required signing closes that path.