3.2.2 - SMB Enum & Common Attacks
SMB Enumeration
Netexec
Enumerate Domain Machines for SMB Signing
Validate Credentials
Find Valid Machines for Connection
Enumerate Shared Resources
Enumerate Users and Groups
Dump LSA and NTDS If you have domain admin privileges:
SMBMap
We can enumerate SMB shares and access to system using these command:
Copy
List a specific Share
Check OS Version and signing status
If the signing of message is disabled we can use it for Relay attacks and potentially of exploit eternalblue vuln.
SMB Client
Similar to SMBMap, we can use it to enumerate shares and interact with file system prompt
Useful for enumerate shares, discovering sensitive files, ACLs for shares, networks, computers, etc, and generates a nice HTML report.
SMB Tools & Guest or Anonymous access to Shares
RCE Via access to Administrative Shares
SMB Brute Forcing
SMB Password Spraying
SMBv1 EternalBlue (CVE-2017-0144)
Net-NTLM Capture Attack
Pass the Hash Attack (PTH)
Net-NTLM Relay Attack
Last updated
