SMB Common Attacks
Sections
SMB Intro
Making the Lab vulnerable
SMB Tools & Guest or Anonymous access to Shares
RCE Via access to Administrative Shares
SMB Brute Forcing
SMB Password Spraying
SMBv1 EternalBlue (CVE-2017-0144)
Net-NTLM Capture Attack
Pass the Hash Attack (PTH)
Net-NTLM Relay Attack
Other Resources
SMB Intro
The SMB protocol is a network file sharing protocol that allows applications on a computer to read and write to files. SMB also requests services from server programs in a computer network. It's the most critical attack vector if it's not protected well.
The v1 is deprecated and have several vulnerabilities (Eternal Blue, WannaCry, etc).
It can run over multiple ports: 445, 137-139 (NetBIOS), and over UDP.
Making the Lab vulnerable
Create a Share
To test it, i've created a share folder called "SharedFiles" with a text file. This directory is shared with 'devan' with read/write rights (Properties->Share->AddUser: 'devan')
Location: \\CORP-DC\SharedFiles
Then, we can access to it on Devan's workstation machine using that location
Disable SMB Signing
By default, SMB signing is enabled on Domain Controllers.
Method 1: Group Policy (Recommended)
Open Group Policy Editor (
gpedit.msc).Navigate to:
Computer Configuration → Windows Settings → Security Settings → Local Policies → Security OptionsSet the following to Disabled:
"Microsoft network server: Digitally sign communications (always)"
"Microsoft network server: Digitally sign communications (if client agrees)"
Restart the server.
Method 2: Registry (Manual)
Enable Guest & Anonymous Access
Method 1: Group Policy (Recommended)
Open Group Policy Editor (
gpedit.msc).Navigate to:
Computer Configuration → Administrative Templates → Network → Lanman WorkstationEnable "Enable insecure guest logons".
Then, go to:
Computer Configuration → Windows Settings → Security Settings → Local Policies → Security OptionsSet the following to Enabled:
"Network access: Let Everyone permissions apply to anonymous users"
"Accounts: Guest account status"
Restart the server.
Method 2: Registry (Manual)
Allow Anonymous Access to a Specific SMB Share
Method 1: Security Policy (secpol.msc)
Open Local Security Policy (
secpol.msc).Navigate to:
Security Settings → Local Policies → Security OptionsModify "Network access: Shares that can be accessed anonymously" and add "SharedFiles".
Restart the server.
Method 2: Registry (Manual)
SMB Tools & Guest or Anonymous access to Shares
SMBMap
We can enumerate SMB shares and access to system using these command:
List a specific Share
Check OS Version and signing status
If the signing of message is disabled we can use it for Relay attacks and potentially of exploit eternalblue vuln.
SMB Client
Similar to SMBMap, we can use it to enumerate shares and interact with file system prompt
Netexec
It's a fantastic tool useful for more common protocols
RCE Via access to Administrative Shares
If it's possible to access administrative shares of SMB, it might be possible to obtain Remote Code Execution (RCE)
In this case we've execute only a whoami command, but for example we can use it for spawn a reverse shell
SMB Brute Forcing
SMB Password Spraying
A password spraying attack involve a threat actor using a single common password against multiple accounts on the same application, because passwords are common and many times multiple users can use the same password.
We can perform it utilizing Netexec
SMBv1 EternalBlue (CVE-2017-0144)
Windows system that running SMBv1, can be vulnerable to dangerous attacks, such as EternalBlue', also known as CVE-2017-0144' or `MS-17-010'.
We can enumerate multiple configuration checking the smb version using previous tools (smbap, netexc) or though 'generic tools' such as: nmap and metasploit framework:
Nmap
Metasploit
Other Lab
Net-NTLM Capture Attack
When a Windows client authenticates to an SMB server, the NTLM hash of the client is sent to the server for authentication. Depending on the protocol version, it is transmitted differently:
Net-NTLMv1:
Uses a simple DES encryption scheme based on the NT hash.
Net-NTLMv2:
Uses HMAC-MD5 and a combination of server/client challenges for stronger security.
It is possible to capture a user's Net-NTLM hash by forcing the client to authenticate against a fake SMB server.
Common attack vectors are:
Phishing real users
Exploiting a reverse shell
To set up Responder for capturing Net-NTLM hashes:
Install Responder:
Start Responder on the victim's network interface (kali):
Trigger authentication from the victim machine:
This will leak the Net-NTLM hash:
Cracking the captured Net-NTLM hash (tools: JohnTheRipper or Hashcat):
Pass the Hash Attack (PTH)
If an attacker obtains an NTLM hash (the hash stored into memory, different than NetNTLM hash), it can be used to authenticate as the user without knowing the password.
We can obtain NTLM using tools such as Mimikatz.
Example NTLM Hash:
Using nxc (NetExec) to authenticate:
If the user of the hash is unknown, we can spray it against a list of users:
Net-NTLM Relay Attack
If the captured Net-NTLM hash cannot be cracked, it can be relayed to another system if SMB signing is disabled.
The NTLM relay attack has the following steps:
0) Check if SMB signing is disabled (pre-requisite)
1) Interception of Authentication Attempt
2) Capture of Net-NTLM Challenge-Reponse
3) Relay to Target SMB
4) Obtain Unauthorized Access
Check SMB signing status:
(on attacker machine)
(on target):
If signing is enabled, it must be disabled via GPO or PowerShell:
Obtain a list of vulnerable SMB servers:
192.168.57.9 is the correspective IP of corp-dc
Start server to replay Net-NTLM Hash
Trigger authentication from the victim machine:
Setup Proxychains Proxy
Using the authenticated session via SOCKS proxy:
Other Resources
Last updated
