{"id":2110,"date":"2021-01-09T14:18:46","date_gmt":"2021-01-09T13:18:46","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2110"},"modified":"2024-09-29T10:44:52","modified_gmt":"2024-09-29T08:44:52","slug":"139-445-smb","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2110","title":{"rendered":"139\/445 SMB<\/span>"},"content":{"rendered":"\n

Note<\/em>: 139 = Net\u00adBIOS is a ses\u00adsion lay\u00ader pro\u00adto\u00adcol and ser\u00advice and dif\u00adfer\u00adent from 445 SMB<\/span>.<\/p>\n\n\n\n

Enumeration<\/h2>\n\n\n\n

Mandatory<\/h3>\n\n\n\n

If you have no cre\u00adden\u00adtials yet:<\/p>\n\n\n\n

    \n
  1. Enu\u00admer\u00adate enum4linux:
    enum4linux -a $target<\/code><\/li>\n\n\n\n
  2. Enu\u00admer\u00adate shares:
    smbmap -r -H $target<\/code> -u Guest<\/code>
    smbmap -r -H $target<\/code><\/code>
    nmap --script smb-enum-shares.nse -p445 $target<\/code>
    smbclient --no-pass -L \/\/$target<\/code><\/li>\n\n\n\n
  3. Per\u00adform nbtscan to query valid Net\u00adBIOS names:
    nbtscan -r 10.0.0.0\/24<\/code><\/li>\n\n\n\n
  4. Per\u00adform nmap script scan(s): (! Don\u2019t use all of them, see the nmap script post<\/a> and chosse promis\u00ading nmap scripts!)
    nmap --script=smb-* -p445 $target<\/code><\/li>\n<\/ol>\n\n\n\n

    If you have already user credentials:<\/p>\n\n\n\n

      \n
    1. Enu\u00admer\u00adate shares:
      smbmap -u L4mpje -p 'bureaulampje' -d WORKGROUP -H $target -R<\/code><\/li>\n\n\n\n
    2. Exe\u00adcute a com\u00admand (alter\u00adna\u00adtive\u00adly with pht-winexe<\/a>, Impack\u00adet tools<\/a>, see also Win\u00addows Com\u00admand exe\u00adcu\u00adtion<\/a>):
      smbmap -u ariley -p 'pass' -d WORKGROUP -x 'whoami' -H $target<\/code><\/li>\n<\/ol>\n\n\n\n

      On Windows<\/h4>\n\n\n\n
        \n
      1. Enu\u00admer\u00adate open shares to the tar\u00adget dc01:
        >net view \\\\dc01 \/all<\/code><\/li>\n<\/ol>\n\n\n\n

        Optional<\/h3>\n\n\n\n