search

SMB

  • Server message block

  • default config

    • cat /etc/samba/smb.conf | grep -v "#\|\;"

  • dangerous settings

    • browseable = yes

    • read only = no

    • writable = yes

    • guest ok = yes

    • enable privileges = yes

    • create mask = 0777

    • directory mask = 0777

    • logon script = script.sh

    • magic script = script.sh

    • magic output = script.out

  • restart service

    • sudo systemctl restart smbd

  • connect

    • lists shares on server

      smbclient -N -L //10.129.14.128

    • connect to notes share

      smbclient //10.129.14.128/notes

To connect to smb with a user specify '-U user'

  • get status

    • smbstatus

  • nmap

  • rpclient

    • can offer us different requests

      • srvinfo - server info

      • enumdomains - enumerate all domains

      • querydominfo - provides domains, server and user info

      • netshareenumall - enumerates all shares

      • netsharegetinfo <share> - enumerates specific share

      • enumdomusers - enumerates all domain users

      • queryuser <rid> - enumerates specific user

  • Brute force user RIDs

    • alternative to this is to use samrdump.py from impacket.

  • smbmap

  • crackmapexec

  • enum4linux

PreviousFTPNextNFS

Last updated