🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

SMB Overview

<aside> 📌 Server Message Block (SMB) is a client-server protocol that regulates access to files and entire directories and other network resources such as printers, routers, or interfaces released for the network. Information exchange between different system processes can also be handled based on the SMB protocol.

</aside>

Samba Overview

<aside> 📌 Samba implements the Common Internet File System (CIFS) network protocol. CIFS  is a "dialect" of SMB. In other words, CIFS is a very specific implementation of the SMB protocol, which in turn was created by Microsoft. This allows Samba to communicate with newer Windows systems. Therefore, it usually is referred to as SMB / CIFS . However, CIFS is the extension of the SMB protocol. So when we pass SMB commands over Samba to an older NetBIOS service, it usually connects to the Samba server over TCP ports 137, 138, 139, but CIFS uses TCP port 445 only.

</aside>

Enumeration Steps

• Attempt a Null session with different tools
• Enumerate shares
• Check what permission you have on the share - (READ only or WRITE )
• When connected enumerate:
  • Group Policy if available to check the password length and lockout counts
  • Enumerate users to create custom list for Brute-forcing [last resort]
• If SMB signing on False means that anonymous access is disabled
• For Brute-force: - try the usernames for passwords to spot bad password practices . Then use rockyou.txt list.
• When attacking a Windows SMB Server, our actions will be limited by the privileges we had on the user we manage to compromise. If this user is an Administrator or has specific privileges, we will be able to perform operations such as:
  • Remote Command Execution
  • Extract Hashes from SAM Database
  • Enumerating Logged-on Users
  • Pass-the-Hash (PTH)

Common Tools

• Nmap Scripts
• SMBClient