Edit

Pentesting SMB

SMB Enumeration

  • The SMB is a network file sharing protocol that provides access to shared files and printers on a local network.

  • When clients and servers use different operating systems and SMB versions, the highest supported version will be used for communication.

  • SMB uses the following TCP and UDP ports:

Netbios-ns 137/tcp #NETBIOS Name Service
Netbios-ns 137/udp
netbios-dgm 138/tcp #NETBIOS Datagram Service
Netbios-dgm 138/udp
Netbios-ssn 139/tcp #NETBIOS session service
Netbios-ssn 139/udp
Microsoft-ds 445/tcp #if you are using active directory

SMB Checklist

  • Basic Commands

  • From SMB command line

  • View/Get Files

get services.txt
more services.txt

  • Enumerate Hostname

  • List Shares

  • Connect to a listed share

  • Check Null Sessions

  • With authentication

  • Check for Vulnerabilities

  • Overall Scan

  • Get a shell with smbmap (windows)

  • Brute Force SMB

smbmap

  • smbmap is one of the best ways to enumerate samba. smbmap allows pen-testers to run commands(given proper permissions), download and upload files, and overall is just incredibly useful for smb enumeration.

  • -s -> specify the share to enumerate

  • -d -> specify the domain to enumerate

  • --download -> downloads a file

  • --upload -> uploads a file

smbclient

  • List shares

  • smbclient allows you to do most of the things you can do with smbmap, and it also offers you and interactive prompt.

  • -w -> specify the domain(workgroup) to use when connecting to the host

  • -I -> specify the ip address of the host

  • -c "ipconfig" -> would run the ipconfig command on the host

  • -U -> specify the username to authenticate with

  • -P -> specifies the password to authenticate with

  • -N -> tells smbclient to not use a password

  • get test -> would download the file named test

  • put /etc/hosts -> would put your /etc/hosts file on the target

  • Syntax:

  • To see which shares are available on a given host, run:

  • For example, if you are trying to reach a directory that has been shared as 'public' on a machine called 10.10.10.10, the service would be called \10.10.10.10\public. -

  • However, due to shell restrictions, you will need to escape the backslashes, so you end up with something like this:

  • To authenticate with a null sessions

  • smbclient with domain credentials

rpcclient

  • A tool used for executing client-side MS-RPC functions. A null session in a connection with a samba or SMB server that does not require authentication with a password.

  • The -U option defines a null username, you will be asked for a password but leave it blank (hit enter!!!!)

  • The command line will change to the rpcclient context

  • To retrieve some general information about the server like the domain and number of users:

  • This command returns the domain, server, total users on the system and some other useful information.

  • Also shows the total number of user accounts and groups available on the target system.

  • To retrieve a list of users present on the system

  • The result is a list of user accounts available on the system with the RID in hex. We can now use rpcclient to query the user info for more information:

  • Enumerate Privleges on the target box

  • Get username you are running as

-This command will return information about the profile path on the server, the home drive, password related settings and a lot more.

  • To see an overview of all enumeration objects just type enum+tabx2.

  • If you get an error that says:

  • Occurs because the minimum protocol version for smbclient has been set to SMB2_02

  • Fix with:

  • Add the following line to the config under the [global] section

  • Alternative method to enumdomusers is through RID cycling.

  • To determine the full SID we can run the: ‘lookupnames’ command and search for the domain with the following command:

  • There are two sets of RIDS 500-1000 for system and 1000-10000 for Domain created users and groups.

  • If we append -500 to the SID and look it up using the lookupsids command we get the following output with the username:

  • Shows SID is unknown, increase by one

  • Find a valid user, increase the RID to 1000.

  • Have the full SID now

lookupsid.py Username Enumeration

  • Impacket’s lookupsid.py performs bruteforcing of Windows SID’s to identify users/groups on the remote target.

  • You need to be able to connect to IPC$ without authentication or with a known password and username

Enum4linux

  • Enum4linux is a linux alternative to enum.exe and it is used to enumerate data from windows or samba hosts.

-Will auto RID cycle

  • Part of autorecon!

  • Recommend to > output to a text file for reference (its alot)

Nmap SMB scripts

  • For smb-os-discovery:

  • First scans the target for all known SMB vulnerabilities

  • Second to see if target is vulnerable to EternalBlue

Finding the Password Policy

  • Various ways to find a box's password policy

  • The reason this will sometimes not work is because when you install a new domain now null sessions will be disabled

  • However when a domain was upgraded from Windows 2000/2003/2008 they kept this feature on in order to have backwards compatibility

Impacket psexec command execution

PreviousPentesting EmailNextPentesting Redis

Last updated