> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/smb-cifs.md).

# SMB/CIFS

**SMB (Server Message Block)** is a network file sharing protocol that allows applications or users to access files on remote servers. Poor configurations or weak credentials can lead to unauthorized access and remote code execution.

***

### Default SMB Ports

| Port | Protocol | Description             |
| ---- | -------- | ----------------------- |
| 139  | TCP      | NetBIOS Session Service |
| 445  | TCP      | SMB over TCP/IP         |

***

### Nmap NSE Scripts

```bash
nmap -p 445 --script=smb-enum* <target-ip>
```

| Script Name        | Description                          |
| ------------------ | ------------------------------------ |
| smb-enum-domains   | Enumerates domains                   |
| smb-enum-groups    | Lists local groups                   |
| smb-enum-processes | Lists running processes              |
| smb-enum-services  | Lists Windows services               |
| smb-enum-sessions  | Lists active SMB sessions            |
| smb-enum-shares    | Lists available shares               |
| smb-enum-users     | Enumerates users                     |
| smb-ls             | Lists files in a share               |
| smb-os-discovery   | Gets OS, workgroup, and NetBIOS info |

***

### Detect SMB Version

#### Using `tcpdump`

* Run tcpdump

  ```bash
  tcpdump -s0 -n -i <interface> src <target-ip> and port 445 -A -c 10 2>/dev/null | grep -i "samba\|s.a.m"
  ```
* Manual Check with smbclient

  ```bash
  smbclient -L //<target-ip>/
  ```

#### Using smbver.sh

Tool:\
<https://github.com/rewardone/OSCPRepo/blob/master/scripts/recon_enum/smbver.sh>

***

### Null Session Enumeration

Try accessing shares with an anonymous session using different path styles:

```bash
smbclient -L //<ip>/ -U "" -N
```

```bash
smbclient //<ip>/C$ -U "" -N
```

```bash
smbclient \\\\<ip>\\share -U "" -N
```

***

## Tools and Usage

### **smbclient**

* List shares:

  ```bash
  smbclient -L //<ip>/ -U "admin" --password 'admin'
  ```
* Access share:

  ```bash
  smbclient //<ip>/share -U "admin"
  ```
* Access with NTLM hash:

  ```bash
  smbclient //<ip>/share -U "admin" --pw-nt-hash "<ntlm-hash>"
  ```
* Access older SMB version:

  ```bash
  smbclient //<ip>/share -U "" --option='client min protocol=NT1'
  ```
* Recursive download (anonymous):

  ```bash
  smbclient //<ip>/share/ -c "recurse ON; prompt OFF; cd directory; mget *"
  ```
* Recursive download (authenticated):

  ```bash
  smbclient //<ip>/SYSVOL/ -U 'username%password' -c "recurse ON; prompt OFF; cd directory; lcd /path/to/local; mget *"
  ```

***

### **impacket-smbclient**

* Access SMB share:

  ```bash
  impacket-smbclient <domain>/<user>:<pass>@<ip>
  ```
* Access share directly:

  ```bash
  impacket-smbclient -username admin -password pass //<ip>/share
  ```
* Access with hash:

  ```bash
  impacket-smbclient <domain>/<user>:<LM>:<NT>@<ip>
  ```

***

### **smbmap**

* Enumerate shares (anonymous):

  ```bash
  smbmap -H <ip> -u guest
  ```
* Enumerate shares (authenticated):

  ```bash
  smbmap -H <ip> -u admin -p password
  ```
* Access using NTLM hash:

  ```bash
  smbmap -H <ip> -u admin -p '' -H <ntlm-hash>
  ```
* Execute remote command:

  ```bash
  smbmap -H <ip> -u admin -p password -x 'ipconfig /all'
  ```

***

### **smbget**

* Download file:

  ```bash
  smbget -U user smb://<ip>/share/file.txt
  ```
* Download with authentication:

  ```bash
  smbget -U user -P pass smb://<ip>/share/
  ```

***

### **Mount SMB Share**

* Mount with credentials:

  ```bash
  mount -t cifs -o username=user,password=pass //<ip>/share /mnt/
  ```

***

### **enum4linux**

* Full enumeration (anonymous):

  ```bash
  enum4linux -a <ip>
  ```
* Specific user and password:

  ```bash
  enum4linux -u admin -p password <ip>
  ```
* Get users only:

  ```bash
  enum4linux -U <ip>
  ```
* Get shares only:

  ```bash
  enum4linux -S <ip>
  ```

***

### Resources

{% embed url="<https://www.hackingarticles.in/a-little-guide-to-smb-enumeration/>" %}

{% embed url="<https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html>" %}