The SMB is a network file sharing protocol that provides access to shared files and printers on a local network.
When clients and servers use different operating systems and SMB versions, the highest supported version will be used for communication.
SMB uses the following TCP and UDP ports:
Netbios-ns 137/tcp #NETBIOS Name Service
Netbios-ns 137/udp
netbios-dgm 138/tcp #NETBIOS Datagram Service
Netbios-dgm 138/udp
Netbios-ssn 139/tcp #NETBIOS session service
Netbios-ssn 139/udp
Microsoft-ds 445/tcp #if you are using active directory
smbmap is one of the best ways to enumerate samba. smbmap allows pen-testers to run commands(given proper permissions), download and upload files, and overall is just incredibly useful for smb enumeration.
smbclient allows you to do most of the things you can do with smbmap, and it also offers you and interactive prompt.
-w -> specify the domain(workgroup) to use when connecting to the host
-I -> specify the ip address of the host
-c "ipconfig" -> would run the ipconfig command on the host
-U -> specify the username to authenticate with
-P -> specifies the password to authenticate with
-N -> tells smbclient to not use a password
get test -> would download the file named test
put /etc/hosts -> would put your /etc/hosts file on the target
Syntax:
To see which shares are available on a given host, run:
/usr/bin/smbclient -L 10.10.10.10
For example, if you are trying to reach a directory that has been shared as 'public' on a machine called 10.10.10.10, the service would be called \10.10.10.10\public. -
However, due to shell restrictions, you will need to escape the backslashes, so you end up with something like this:
A tool used for executing client-side MS-RPC functions. A null session in a connection with a samba or SMB server that does not require authentication with a password.
rpcclient -U "" [target ip address]
The -U option defines a null username, you will be asked for a password but leave it blank (hit enter!!!!)
The command line will change to the rpcclient context
rpcclient $>
To retrieve some general information about the server like the domain and number of users:
querydominfo
This command returns the domain, server, total users on the system and some other useful information.
Also shows the total number of user accounts and groups available on the target system.
To retrieve a list of users present on the system
enumdomusers
The result is a list of user accounts available on the system with the RID in hex. We can now use rpcclient to query the user info for more information:
lookupsids #convert SIDs to names
lookupsids S-1-5-21-3981879597-1135670737-2718083060-1002
lookupnames #convert names to SIDs
lookupnames Bill
queryuser 0x47f #get the user rid form enomdomusers command
queryusergroups 0x47b #use the rid for the username to see their group membership
querygroup 0x47c #when you get the group membership back use those rids for this query
