Network Wizkid

Ethical Hacking, Kelvin

Basic SMB Hacking Notes

Published by

iwiizkiid

on

SMB Ports

SMB Port: 139/445

Port 139 is the older port which ran over NetBIOS. NetBIOS is a transport layer protocol that allows Windows computers to speak to each other on the same network.
Port 445 is the newer port that runs over the TCP/IP Stack. This allows SMB to work over the Internet.

Looking for open SMB ports

Access the network and perform a Nmap scan. I used the following:

nmap -A <host>
Where '<host>' enter the IP address/range that you want to scan
Where '-A' = Enable OS detection, version detection, script scanning, and traceroute

Find the content of a share

Additional commands may be required. Included below are the commands that can be used with smbclient.

smbclient -L <host> 
Where '-L' lists the contents of the share
Where '<host>' enter the IP address of the host

└──╼ $smbclient --help
]Usage: smbclient service <password>
  -R, --name-resolve=NAME-RESOLVE-ORDER     Use these name resolution services
                                            only
  -M, --message=HOST                        Send message
  -I, --ip-address=IP                       Use this IP to connect to
  -E, --stderr                              Write messages to stderr instead
                                            of stdout
  -L, --list=HOST                           Get a list of shares available on
                                            a host
  -m, --max-protocol=LEVEL                  Set the max protocol level
  -T, --tar=<c|x>IXFvgbNan                  Command line tar
  -D, --directory=DIR                       Start from directory
  -c, --command=STRING                      Execute semicolon separated
                                            commands
  -b, --send-buffer=BYTES                   Changes the transmit/send buffer
  -t, --timeout=SECONDS                     Changes the per-operation timeout
  -p, --port=PORT                           Port to connect to
  -g, --grepable                            Produce grepable output
  -q, --quiet                               Suppress help message
  -B, --browse                              Browse SMB servers using DNS
Help options:
  -?, --help                                Show this help message
      --usage                               Display brief usage message
Common samba options:
  -d, --debuglevel=DEBUGLEVEL               Set debug level
  -s, --configfile=CONFIGFILE               Use alternate configuration file
  -l, --log-basename=LOGFILEBASE            Base name for log files
  -V, --version                             Print version
      --option=name=value                   Set smb.conf option from command
                                            line
Connection options:
  -O, --socket-options=SOCKETOPTIONS        socket options to use
  -n, --netbiosname=NETBIOSNAME             Primary netbios name
  -W, --workgroup=WORKGROUP                 Set the workgroup name
  -i, --scope=SCOPE                         Use this Netbios scope
Authentication options:
  -U, --user=USERNAME                       Set the network username
  -N, --no-pass                             Don't ask for a password
  -k, --kerberos                            Use kerberos (active directory)
                                            authentication
  -A, --authentication-file=FILE            Get the credentials from a file
  -S, --signing=on|off|required             Set the client signing state
  -P, --machine-pass                        Use stored machine account password
  -e, --encrypt                             Encrypt SMB transport
  -C, --use-ccache                          Use the winbind ccache for
                                            authentication
      --pw-nt-hash                          The supplied password is the NT
                                            hash

Connect to an SMB shell

smbclient //<host>/<share>
Example: smbclient //10.10.10.1/workshare

Saving a file to your system

When connected to the SMB shell, navigate to the location of interest and extract the file/s of interest.

smb:> cd
smb: \User1\> ls
  .                                   D        0  Thu Jun  3 09:38:03 2021
  ..                                  D        0  Thu Jun  3 09:38:03 2021
  file.txt                            A       32  Mon Mar 29 10:26:57 2021
		5114111 blocks of size 4096. 1751933 blocks available
smb: \User1\> get file.txt
getting file \User1\file.txt of size 32 as file.txt (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)

Additional commands can be used. See other commands below.

smb: \User1\> ?
?              allinfo        altname        archive        backup         
blocksize      cancel         case_sensitive cd             chmod          
chown          close          del            deltree        dir            
du             echo           exit           get            getfacl        
geteas         hardlink       help           history        iosize         
lcd            link           lock           lowercase      ls             
l              mask           md             mget           mkdir          
more           mput           newer          notify         open           
posix          posix_encrypt  posix_open     posix_mkdir    posix_rmdir    
posix_unlink   posix_whoami   print          prompt         put            
pwd            q              queue          quit           readlink       
rd             recurse        reget          rename         reput          
rm             rmdir          showacls       setea          setmode        
scopy          stat           symlink        tar            tarmode        
timeout        translate      unlock         volume         vuid           
wdel           logon          listconnect    showconnect    tcon           
tdis           tid            utimes         logoff         ..             
!

Leave a ReplyCancel reply