Ctrlk
Edit

Pentesting SMB

SMB Enumeration

  • The SMB is a network file sharing protocol that provides access to shared files and printers on a local network.

  • When clients and servers use different operating systems and SMB versions, the highest supported version will be used for communication.

  • SMB uses the following TCP and UDP ports:

Netbios-ns 137/tcp #NETBIOS Name Service
Netbios-ns 137/udp
netbios-dgm 138/tcp #NETBIOS Datagram Service
Netbios-dgm 138/udp
Netbios-ssn 139/tcp #NETBIOS session service
Netbios-ssn 139/udp
Microsoft-ds 445/tcp #if you are using active directory

SMB Checklist

  • Basic Commands

  • From SMB command line

  • View/Get Files

get services.txt
more services.txt

  • Enumerate Hostname

  • List Shares

If Samba is on a non-standard port, pass the port explicitly:

  • Connect to a listed share

  • Check Null Sessions

  • With authentication

  • Check for Vulnerabilities

  • Overall Scan

  • Get a shell with smbmap (windows)

  • Brute Force SMB

smbmap

  • smbmap is one of the best ways to enumerate samba. smbmap allows pen-testers to run commands(given proper permissions), download and upload files, and overall is just incredibly useful for smb enumeration.

  • -s -> specify the share to enumerate

  • -d -> specify the domain to enumerate

  • --download -> downloads a file

  • --upload -> uploads a file

smbclient

  • List shares

  • smbclient allows you to do most of the things you can do with smbmap, and it also offers you and interactive prompt.

  • -w -> specify the domain(workgroup) to use when connecting to the host

  • -I -> specify the ip address of the host

  • -c "ipconfig" -> would run the ipconfig command on the host

  • -U -> specify the username to authenticate with

  • -P -> specifies the password to authenticate with

  • -N -> tells smbclient to not use a password

  • get test -> would download the file named test

  • put /etc/hosts -> would put your /etc/hosts file on the target

  • Syntax:

  • To see which shares are available on a given host, run:

  • For example, if you are trying to reach a directory that has been shared as 'public' on a machine called 10.10.10.10, the service would be called \10.10.10.10\public. -

  • However, due to shell restrictions, you will need to escape the backslashes, so you end up with something like this:

  • To authenticate with a null sessions

  • smbclient with domain credentials

rpcclient

  • A tool used for executing client-side MS-RPC functions. A null session in a connection with a samba or SMB server that does not require authentication with a password.

  • The -U option defines a null username, you will be asked for a password but leave it blank (hit enter!!!!)

  • The command line will change to the rpcclient context

  • To retrieve some general information about the server like the domain and number of users:

  • This command returns the domain, server, total users on the system and some other useful information.

  • Also shows the total number of user accounts and groups available on the target system.

  • To retrieve a list of users present on the system

  • The result is a list of user accounts available on the system with the RID in hex. We can now use rpcclient to query the user info for more information:

  • Enumerate Privleges on the target box

  • Get username you are running as

-This command will return information about the profile path on the server, the home drive, password related settings and a lot more.

  • To see an overview of all enumeration objects just type enum+tabx2.

  • If you get an error that says:

  • Occurs because the minimum protocol version for smbclient has been set to SMB2_02

  • Fix with:

  • Add the following line to the config under the [global] section

  • Alternative method to enumdomusers is through RID cycling.

  • To determine the full SID we can run the: ‘lookupnames’ command and search for the domain with the following command:

  • There are two sets of RIDS 500-1000 for system and 1000-10000 for Domain created users and groups.

  • If we append -500 to the SID and look it up using the lookupsids command we get the following output with the username:

  • Shows SID is unknown, increase by one

  • Find a valid user, increase the RID to 1000.

  • Have the full SID now

Manual RID Cycling Technique

When enumdomusers fails, manually cycle through RIDs to find users:

Key RID ranges:

RID
Description

500

Administrator

501

Guest

502

krbtgt (DCs only)

512-519

Domain groups

1000+

User-created accounts

Tip: Cycle through RIDs 500, 501, then 1000-1050 to find hidden users when other enumeration fails.

lookupsid.py Username Enumeration

  • Impacket’s lookupsid.py performs bruteforcing of Windows SID’s to identify users/groups on the remote target.

  • You need to be able to connect to IPC$ without authentication or with a known password and username

Enum4linux

  • Enum4linux is a linux alternative to enum.exe and it is used to enumerate data from windows or samba hosts.

-Will auto RID cycle

  • Part of autorecon!

  • Recommend to > output to a text file for reference (its alot)

Nmap SMB scripts

  • For smb-os-discovery:

  • First scans the target for all known SMB vulnerabilities

  • Second to see if target is vulnerable to EternalBlue

Finding the Password Policy

  • Various ways to find a box's password policy

  • The reason this will sometimes not work is because when you install a new domain now null sessions will be disabled

  • However when a domain was upgraded from Windows 2000/2003/2008 they kept this feature on in order to have backwards compatibility

Impacket psexec command execution

Bruteforcing SMB

  • If bruteforcing smb, remember that hydra does not support smbv1

  • If your target is non domain joined, ensure you have a .\ in front of your username

  • --ignore-pw-decoding is required for rockyou.txt

Samba Configuration

Config File

  • Config path: /etc/samba/smb.conf

Restart Samba

SMB Version History

SMB Version
Supported
Features

CIFS

Windows NT 4.0

Communication via NetBIOS interface

SMB 1.0

Windows 2000

Direct connection via TCP

SMB 2.0

Windows Vista, Windows Server 2008

Performance upgrades, improved message signing, caching feature

SMB 2.1

Windows 7, Windows Server 2008 R2

Locking mechanisms

SMB 3.0

Windows 8, Windows Server 2012

Multichannel connections, end-to-end encryption, remote storage access

SMB 3.0.2

Windows 8.1, Windows Server 2012 R2

SMB 3.1.1

Windows 10, Windows Server 2016

Integrity checking, AES-128 encryption

Dangerous Samba Settings

Setting
Description

browseable = yes

Allow listing shares

read only = no

Allow file modification

writable = yes

Allow creation/modification

guest ok = yes

No password required

enable privileges = yes

Honor SID-based privileges

create mask = 0777

World-writable new files

directory mask = 0777

World-writable new dirs

logon script = script.sh

Script on login

magic script = script.sh

Script on file close

magic output = script.out

Magic script output file

RPCclient Commands Reference

Command
Description

srvinfo

Server information

enumdomains

Enumerate all domains

querydominfo

Domain, server, user count

netshareenumall

Enumerate all available shares

netsharegetinfo <share>

Share info by name

enumdomusers

Enumerate domain users

queryuser <RID>

User info by RID

querygroup <RID>

Group info by RID

RID Brute Force (Bash Loop)

Impacket samrdump.py

Samba Status (Server-side)

SMB Share Interaction

Windows CMD

List directory, count files, search filenames for creds/secrets, and search inside files:

Windows PowerShell

Map drive:

Map drive with credentials:

Search files:

Linux Mount

Mount with credential file:

Credential file format:

Search mounted shares:

smbmap Advanced Usage

Browse directory contents:

Download file:

Upload file:

NetExec Advanced Usage

Password Spraying

  • --continue-on-success — keep spraying after a valid hit

  • --local-auth — for non-domain joined machines

Remote Command Execution

  • -x — execute cmd commands

  • -X — execute PowerShell commands

  • --exec-method — smbexec, mmcexec, atexec, wmiexec

Enumerate Logged-on Users

Extract SAM Hashes

Pass-the-Hash

Impacket PsExec

Responder — LLMNR/NBT-NS Hash Capture

Responder poisons LLMNR, NBT-NS, and MDNS responses on the local network to capture NTLMv2 hashes when a victim makes a request to a nonexistent share or host.

Captured hashes stored in /usr/share/responder/logs/.

Crack NTLMv2 hash with Hashcat (module 5600):

NTLM Relay

Relay captured NTLM authentication to a different host instead of cracking. Requires SMB signing disabled on the target.

Disable SMB in Responder config:

Relay to dump SAM:

Relay with reverse shell command:

Catch shell:

Use impacket-smbserver to create a fake SMB share and capture hashes:

Authenticated SMB File Server (for Transfers)

When guest access is blocked, use an authenticated smbserver:

Map the share from PowerShell on the target:

SMBGhost (CVE-2020-0796)

  • Affects SMBv3.1.1 compression in Windows 10 versions 1903 and 1909

  • Integer overflow vulnerability leading to remote code execution

  • No authentication required

  • PoC: https://www.exploit-db.com/exploits/48537

  • If you already have a Meterpreter session, Metasploit's local module can escalate vulnerable Windows 10 v1903/v1909 x64 targets to SYSTEM:

Successful output includes:

PreviousPentesting phpMyAdminNextPentesting Redis

Last updated