> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/crtp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/crtp-notes/readme/network-security-1/3.2-common-services-enum/3.2.2-smb-enum-and-common-attacks.md).
# 3.2.2 - SMB Enum & Common Attacks
## **SMB Enumeration**
### **Netexec**
1. **Enumerate Domain Machines for SMB Signing**
```bash
nxc smb 192.168.1.0/24
```
2. **Validate Credentials**
```bash
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123'
```
3. **Find Valid Machines for Connection**
```bash
nxc smb 192.168.1.0/24 -u 'jdoe' -p 'Password123'
```
4. **Enumerate Shared Resources**
```bash
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123' --shares
```
5. **Enumerate Users and Groups**
```bash
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123' --users
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123' --groups
```
6. **Dump LSA and NTDS** If you have domain admin privileges:
```bash
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123' --lsa
nxc smb 192.168.1.1 -u 'jdoe' -p 'Password123' --ntds
```
***
### SMBMap
We can enumerate SMB shares and access to system using these command:
Copy
```bash
smbmap -H corp-dc #List share with anonymous access
smbmap -H corp-dc -u "devan" -p "P@ssword123!" #List Devan's shares
smbmap -H corp-dc -u "devan" --prompt ##List Devan's shares without writing password in cleartext
```
**List a specific Share**
```bash
smbmap -H corp-dc -u "devan" --prompt -r "SharedFiles"
```
**Check OS Version and signing status**
```bash
smbmap -H corp-dc -u "devan" --prompt -v #OS version check
smbmap -H corp-dc -u "devan" --prompt --signing #Signing check
```
If the signing of message is disabled we can use it for Relay attacks and potentially of exploit eternalblue vuln.
***
## SMB Client
Similar to SMBMap, we can use it to enumerate shares and interact with file system prompt
```bash
smbclient -L //corp-dc -N #Anonymous Login (-N no credentials)
smbclient //corp-dc -U "dev-angelist.lab/devan%P@ssword123!" #List Devan's shares
smbclient //corp-dc/SharedFiles -U devan
smbclient //corp-dc/SharedFiles -U "dev-angelist.lab/devan%P@ssword123!" #we can get file shared using get command
#File system prompt includes command such as: cd, dir, ls, get, put
```
***
## [PowerHuntShares](https://github.com/NetSPI/PowerHuntShares)
Useful for enumerate shares, discovering sensitive files, ACLs for shares, networks, computers, etc, and generates a nice HTML report.
```powershell
Invoke-HuntSMBShares -NoPing -OutputDirectory C:\AD\Tools -HostList C:\AD\Tools\servers.txt
```
## [SMB Common Attacks](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/homemade-labs/active-directory/smb-common-attacks)
* SMB Tools & Guest or Anonymous access to Shares
* RCE Via access to Administrative Shares
* SMB Brute Forcing
* SMB Password Spraying
* SMBv1 EternalBlue (CVE-2017-0144)
* Net-NTLM Capture Attack
* Pass the Hash Attack (PTH)
* Net-NTLM Relay Attack
[SMB Common Attacks Lab](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/homemade-labs/active-directory/smb-common-attacks)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://dev-angelist.gitbook.io/crtp-notes/readme/network-security-1/3.2-common-services-enum/3.2.2-smb-enum-and-common-attacks.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
