HomeGitHubPortfolio Twitter/X Medium Cont@ct

SMB Common Attacks

Sections

  1. SMB Intro

  2. Making the Lab vulnerable

  3. SMB Tools & Guest or Anonymous access to Shares

  4. RCE Via access to Administrative Shares

  5. SMB Brute Forcing

  6. SMB Password Spraying

  7. SMBv1 EternalBlue (CVE-2017-0144)

  8. Net-NTLM Capture Attack

  9. Pass the Hash Attack (PTH)

  10. Net-NTLM Relay Attack

  11. Other Resources

SMB Intro

The SMB protocol is a network file sharing protocol that allows applications on a computer to read and write to files. SMB also requests services from server programs in a computer network. It's the most critical attack vector if it's not protected well.

The v1 is deprecated and have several vulnerabilities (Eternal Blue, WannaCry, etc).

It can run over multiple ports: 445, 137-139 (NetBIOS), and over UDP.

Making the Lab vulnerable

Create a Share

To test it, i've created a share folder called "SharedFiles" with a text file. This directory is shared with 'devan' with read/write rights (Properties->Share->AddUser: 'devan')

Location: \\CORP-DC\SharedFiles

Then, we can access to it on Devan's workstation machine using that location

Disable SMB Signing

By default, SMB signing is enabled on Domain Controllers.

Method 1: Group Policy (Recommended)

  1. Open Group Policy Editor (gpedit.msc).

  2. Navigate to: Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options

  3. Set the following to Disabled:

    • "Microsoft network server: Digitally sign communications (always)"

    • "Microsoft network server: Digitally sign communications (if client agrees)"

  4. Restart the server.

Method 2: Registry (Manual)

Enable Guest & Anonymous Access

Method 1: Group Policy (Recommended)

  1. Open Group Policy Editor (gpedit.msc).

  2. Navigate to: Computer Configuration → Administrative Templates → Network → Lanman Workstation

  3. Enable "Enable insecure guest logons".

  4. Then, go to: Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options

  5. Set the following to Enabled:

    • "Network access: Let Everyone permissions apply to anonymous users"

    • "Accounts: Guest account status"

  6. Restart the server.

Method 2: Registry (Manual)

Allow Anonymous Access to a Specific SMB Share

Method 1: Security Policy (secpol.msc)

  1. Open Local Security Policy (secpol.msc).

  2. Navigate to: Security Settings → Local Policies → Security Options

  3. Modify "Network access: Shares that can be accessed anonymously" and add "SharedFiles".

  4. Restart the server.

Method 2: Registry (Manual)

SMB Tools & Guest or Anonymous access to Shares

If the passwords used include special characters, the ideal way to overcome the problem would be to insert them via prompt (as well as for security reasons), in addition you can try to indicate them via "" or '' or by using escaping characters.

SMBMap

We can enumerate SMB shares and access to system using these command:

List a specific Share

Check OS Version and signing status

If the signing of message is disabled we can use it for Relay attacks and potentially of exploit eternalblue vuln.

SMB Client

Similar to SMBMap, we can use it to enumerate shares and interact with file system prompt

Netexec

It's a fantastic tool useful for more common protocols

RCE Via access to Administrative Shares

If it's possible to access administrative shares of SMB, it might be possible to obtain Remote Code Execution (RCE)

In this case we've execute only a whoami command, but for example we can use it for spawn a reverse shell

SMB Brute Forcing

When we're talking about login, we must talk about brute force attack. To perform this we can use tools such as Hydra or Legba (suggested for SMB protocol and running with docker)

LogoGitHub - evilsocket/legba: The fastest and more comprehensive multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷GitHub

SMB Password Spraying

A password spraying attack involve a threat actor using a single common password against multiple accounts on the same application, because passwords are common and many times multiple users can use the same password.

We can perform it utilizing Netexec

SMBv1 EternalBlue (CVE-2017-0144)

Windows system that running SMBv1, can be vulnerable to dangerous attacks, such as EternalBlue', also known as CVE-2017-0144' or `MS-17-010'.

We can enumerate multiple configuration checking the smb version using previous tools (smbap, netexc) or though 'generic tools' such as: nmap and metasploit framework:

Nmap

Metasploit

Other Lab

Net-NTLM Capture Attack

When a Windows client authenticates to an SMB server, the NTLM hash of the client is sent to the server for authentication. Depending on the protocol version, it is transmitted differently:

  • Net-NTLMv1:

    • Uses a simple DES encryption scheme based on the NT hash.

  • Net-NTLMv2:

    • Uses HMAC-MD5 and a combination of server/client challenges for stronger security.

It is possible to capture a user's Net-NTLM hash by forcing the client to authenticate against a fake SMB server.

Common attack vectors are:

  • Phishing real users

  • Exploiting a reverse shell

To set up Responder for capturing Net-NTLM hashes:

  1. Install Responder:

  2. Start Responder on the victim's network interface (kali):

  1. Trigger authentication from the victim machine:

This will leak the Net-NTLM hash:

  1. Cracking the captured Net-NTLM hash (tools: JohnTheRipper or Hashcat):

Pass the Hash Attack (PTH)

If an attacker obtains an NTLM hash (the hash stored into memory, different than NetNTLM hash), it can be used to authenticate as the user without knowing the password.

We can obtain NTLM using tools such as Mimikatz.

Example NTLM Hash:

Using nxc (NetExec) to authenticate:

If the user of the hash is unknown, we can spray it against a list of users:

Net-NTLM Relay Attack

If the captured Net-NTLM hash cannot be cracked, it can be relayed to another system if SMB signing is disabled.

The NTLM relay attack has the following steps:

0) Check if SMB signing is disabled (pre-requisite)

1) Interception of Authentication Attempt

2) Capture of Net-NTLM Challenge-Reponse

3) Relay to Target SMB

4) Obtain Unauthorized Access

Check SMB signing status:

(on attacker machine)

(on target):

If signing is enabled, it must be disabled via GPO or PowerShell:

Obtain a list of vulnerable SMB servers:

192.168.57.9 is the correspective IP of corp-dc

Start server to replay Net-NTLM Hash

Trigger authentication from the victim machine:

Setup Proxychains Proxy

Using the authenticated session via SOCKS proxy:

Other Resources

PreviousAD EnumerationNextPivoting

Last updated