139,445 - Pentesting SMB
Port 139
The Network Basic Input Output System** (NetBIOS)** is a software protocol designed to enable applications, PCs, and Desktops within a local area network (LAN) to interact with network hardware and facilitate the transmission of data across the network. The identification and location of software applications operating on a NetBIOS network are achieved through their NetBIOS names, which can be up to 16 characters in length and are often distinct from the computer name. A NetBIOS session between two applications is initiated when one application (acting as the client) issues a command to "call" another application (acting as the server) utilizing TCP Port 139.
Port 445
Technically, Port 139 is referred to as ‘NBT over IP’, whereas Port 445 is identified as ‘SMB over IP’. The acronym SMB stands for ‘Server Message Blocks’, which is also modernly known as the Common Internet File System (CIFS). As an application-layer network protocol, SMB/CIFS is primarily utilized to enable shared access to files, printers, serial ports, and facilitate various forms of communication between nodes on a network.
For example, in the context of Windows, it is highlighted that SMB can operate directly over TCP/IP, eliminating the necessity for NetBIOS over TCP/IP, through the utilization of port 445. Conversely, on different systems, the employment of port 139 is observed, indicating that SMB is being executed in conjunction with NetBIOS over TCP/IP.
SMB
The Server Message Block (SMB) protocol, operating in a client-server model, is designed for regulating access to files, directories, and other network resources like printers and routers. Primarily utilized within the Windows operating system series, SMB ensures backward compatibility, allowing devices with newer versions of Microsoft's operating system to seamlessly interact with those running older versions. Additionally, the Samba project offers a free software solution, enabling SMB's implementation on Linux and Unix systems, thereby facilitating cross-platform communication through SMB.
Shares, representing arbitrary parts of the local file system, can be provided by an SMB server, making the hierarchy visible to a client partly independent from the server's actual structure. The Access Control Lists (ACLs), which define access rights, allow for fine-grained control over user permissions, including attributes like execute
, read
, and full access
. These permissions can be assigned to individual users or groups, based on the shares, and are distinct from the local permissions set on the server.
IPC$ Share
Access to the IPC$ share can be obtained through an anonymous null session, allowing for interaction with services exposed via named pipes. The utility enum4linux
is useful for this purpose. Utilized properly, it enables the acquisition of:
Information on the operating system
Details on the parent domain
A compilation of local users and groups
Information on available SMB shares
The effective system security policy
This functionality is critical for network administrators and security professionals to assess the security posture of SMB (Server Message Block) services on a network. enum4linux
provides a comprehensive view of the target system's SMB environment, which is essential for identifying potential vulnerabilities and ensuring that the SMB services are properly secured.
The above command is an example of how enum4linux
might be used to perform a full enumeration against a target specified by target_ip
.
What is NTLM
If you don't know what is NTLM or you want to know how it works and how to abuse it, you will find very interesting this page about NTLM where is explained how this protocol works and how you can take advantage of it:
NTLMServer Enumeration
Scan a network searching for hosts:
SMB server version
To look for possible exploits to the SMB version it important to know which version is being used. If this information does not appear in other used tools, you can:
Use the MSF auxiliary module _auxiliary/scanner/smb/smb_version
Or this script:
Search exploit
Possible Credentials
Username(s) | Common passwords |
(blank) | (blank) |
guest | (blank) |
Administrator, admin | (blank), password, administrator, admin |
arcserve | arcserve, backup |
tivoli, tmersrvd | tivoli, tmersrvd, admin |
backupexec, backup | backupexec, backup, arcada |
test, lab, demo | password, test, lab, demo |
Brute Force
SMB Environment Information
Obtain Information
Enumerate Users, Groups & Logged On Users
This info should already being gathered from enum4linux and enum4linux-ng
Enumerate local users
Oneliner
Metasploit - Enumerate local users
Enumerating LSARPC and SAMR rpcclient
rpcclient enumerationGUI connection from linux
In the terminal:
xdg-open smb://cascade.htb/
In file browser window (nautilus, thunar, etc)
smb://friendzone.htb/general/
Shared Folders Enumeration
List shared folders
It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.
Connect/List a shared folder
Manually enumerate windows shares and connect to them
It may be possible that you are restricted to display any shares of the host machine and when you try to list them it appears as if there aren't any shares to connect to. Thus it might be worth a short to try to manually connect to a share. To enumerate the shares manually you might want to look for responses like NT_STATUS_ACCESS_DENIED and NT_STATUS_BAD_NETWORK_NAME, when using a valid session (e.g. null session or valid credentials). These may indicate whether the share exists and you do not have access to it or the share does not exist at all.
Common share names for windows targets are
C$
D$
ADMIN$
IPC$
PRINT$
FAX$
SYSVOL
NETLOGON
(Common share names from Network Security Assessment 3rd edition)
You can try to connect to them by using the following command
or this script (using a null session)
examples
Enumerate shares from Windows / without third-party tools
PowerShell
CMD console
MMC Snap-in (graphical)
explorer.exe (graphical), enter \\<ip>\
to see the available non-hidden shares.
Mount a shared folder
Download files
Read previous sections to learn how to connect with credentials/Pass-the-Hash.
Commands:
mask: specifies the mask which is used to filter the files within the directory (e.g. "" for all files)
recurse: toggles recursion on (default: off)
prompt: toggles prompting for filenames off (default: on)
mget: copies all files matching the mask from host to client machine
(Information from the manpage of smbclient)
Domain Shared Folders Search
Snaffler****
CrackMapExec spider.
-M spider_plus [--share <share_name>]
--pattern txt
Specially interesting from shares are the files called Registry.xml
as they may contain passwords for users configured with autologon via Group Policy. Or web.config
files as they contains credentials.
The SYSVOL share is readable by all authenticated users in the domain. In there you may find many different batch, VBScript, and PowerShell scripts. You should check the scripts inside of it as you might find sensitive info such as passwords.
Read Registry
You may be able to read the registry using some discovered credentials. Impacket reg.py
allows you to try:
Post Exploitation
The default config of a Samba server is usually located in /etc/samba/smb.conf
and might have some dangerous configs:
Setting | Description |
| Allow listing available shares in the current share? |
| Forbid the creation and modification of files? |
| Allow users to create and modify files? |
| Allow connecting to the service without using a password? |
| Honor privileges assigned to specific SID? |
| What permissions must be assigned to the newly created files? |
| What permissions must be assigned to the newly created directories? |
| What script needs to be executed on the user's login? |
| Which script should be executed when the script gets closed? |
| Where the output of the magic script needs to be stored? |
The command smbstatus
gives information about the server and about who is connected.
Authenticate using Kerberos
You can authenticate to kerberos using the tools smbclient and rpcclient:
Execute Commands
crackmapexec
crackmapexec can execute commands abusing any of mmcexec, smbexec, atexec, wmiexec being wmiexec the default method. You can indicate which option you prefer to use with the parameter --exec-method
:
Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershell.exe and put in the arguments the payload --file-less technique--). More info about psexec and smbexec. In kali it is located on /usr/share/doc/python3-impacket/examples/
Using parameter-k
you can authenticate against kerberos instead of NTLM
wmiexec/dcomexec
Stealthily execute a command shell without touching the disk or running a new service using DCOM via port 135. In kali it is located on /usr/share/doc/python3-impacket/examples/
Using parameter-k
you can authenticate against kerberos instead of NTLM
Execute commands via the Task Scheduler (using \pipe\atsvc via SMB). In kali it is located on /usr/share/doc/python3-impacket/examples/
Impacket reference
https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/
Bruteforce users credentials
This is not recommended, you could block an account if you exceed the maximum allowed tries
SMB relay attack
This attack uses the Responder toolkit to capture SMB authentication sessions on an internal network, and relays them to a target machine. If the authentication session is successful, it will automatically drop you into a system shell. More information about this attack here.
SMB-Trap
The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: img src="\\10.10.10.10\path\image.jpg"
This happens with the functions:
URLDownloadToFile
URLDownloadToCache
URLOpenStream
URLOpenBlockingStream
Which are used by some browsers and tools (like Skype)
SMBTrap using MitMf
NTLM Theft
Similar to SMB Trapping, planting malicious files onto a target system (via SMB, for example) can illicit an SMB authentication attempt, allowing the NetNTLMv2 hash to be intercepted with a tool such as Responder. The hash can then be cracked offline or used in an SMB relay attack.
HackTricks Automatic Commands
Last updated