{"id":1473,"date":"2020-05-13T08:57:31","date_gmt":"2020-05-13T06:57:31","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1473"},"modified":"2024-08-18T11:43:51","modified_gmt":"2024-08-18T09:43:51","slug":"smb","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1473","title":{"rendered":"<span class=\"caps\">SMB<\/span> Server Message Block"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Show shares with smbclient:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">smbclient --no-pass -L \/\/$target<br>smbclient -U guest \/\/$target\/<br>smbclient -U Administrator --pw-nt-hash $NTLMHASH \\\\\\\\$target\\\\directory<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show shares with oth\u00ader clients:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">smbmap -R -H $target \/\/ No user<br>smbmap -u L4mpje -p 'bureaulampje' -d WORKGROUP -H $target -R \/\/ User<br><br>nmap -sV --script=smb-enum-shares -p445 $target<br>crackmapexec smb $target -u '' -p '' --shares<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Vul\u00adner\u00ada\u00adbil\u00adi\u00adty&nbsp;scan<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap --script=smb-vul* -p445 $target\nproxychains4 nmap --script=smb-vul* -p445 -Pn -sT $target<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enu\u00admer\u00adate through an exist\u00ading list of users and passwords:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">for cred in $(cat other_users.txt); do\n  username=$(echo $cred | cut -d ',' -f 1)\n  password=$(echo $cred | cut -d ',' -f 2 )\n  echo \"$username \/ $password\"\n  smbmap -R -H $victim -u $username -p $password\ndone;<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Mount direc\u00adto\u00adry<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mount -t cifs -o user=bob,domain=THINC.LOCAL,vers=1.0 \/\/$target\/Bob \/mnt<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Copy<\/strong> whole share with smb\u00adclient (<a href=\"https:\/\/superuser.com\/questions\/856617\/how-do-i-recursively-download-a-directory-using-smbclient\">oth\u00ader option for sub\u00addi\u00adrec\u00adto\u00adry<\/a>):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">smbclient '\\\\$target\\sharename' -N -c 'prompt OFF;recurse ON;mget *'<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Execute commands<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">smbmap -u ariley -p 'pass' -d WORKGROUP -x 'whoami' -H $target<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">See also the <a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=1222\" data-type=\"post\" data-id=\"1222\">Impack\u00adet&nbsp;post<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Connect to shares via&nbsp;cmd<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use the fol\u00adlow\u00ading to con\u00adnect from a client to anoth\u00ader client.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">net use M: \\\\$target\\share $password \/u:$domain\\$username<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After\u00adwards, always disconnect!<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">net use \\\\$target \/del<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show all drives:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">net use<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Show shares with smb\u00adclient: smb\u00adclient \u2013no-pass \u2011L \/\/$targetsmbclient \u2011U guest \/\/$target\/smbclient \u2011U Admin\u00adis\u00adtra\u00adtor \u2013pw-nt-hash $<span class=\"caps\">NTLMHASH<\/span> \\\\\\\\$target\\\\directory Show shares with oth\u00ader clients: smbmap \u2011R \u2011H $tar\u00adget \/\/ No usersmbmap \u2011u L4mpje \u2011p \u2018bureaulam\u00adp\u00adje\u2019 \u2011d <span class=\"caps\">WORKGROUP<\/span> \u2011H $tar\u00adget \u2011R \/\/ Usern\u00admap \u2011sV \u2013script=smb-enum-shares \u2011p445 $tar\u00adget\u00adcrackmapex\u00adec smb $tar\u00adget \u2011u \u201d \u2011p \u201d \u2013shares Vul\u00adner\u00ada\u00adbil\u00adi\u00adty&nbsp;scan nmap \u2013script=smb-vul* \u2011p445 $tar\u00adget [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[323],"tags":[54],"class_list":["post-1473","post","type-post","status-publish","format-standard","hentry","category-protocol","tag-smb"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1473"}],"version-history":[{"count":14,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1473\/revisions"}],"predecessor-version":[{"id":4048,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1473\/revisions\/4048"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}