139,445 - SMB
Introduction
Port: 139,445 (TCP)
The Server Message Block (SMB) is a network protocol used by Windows-based computers that allow systems within the same network to share files. This service can run on either port 139 or port 445 by default.
SMB General Enumeration
A quick way to discover NetBIOS services on a network is with nbtscan.
nbtscan -r <NETWORK>/<MASK>With Nmap, you can obtain domains, groups, processes, services, sessions, shares and users.
sudo nmap --script "smb-enum-*" -p139,445 <TARGET>
sudo nmap --script "smb2*" -p139,445 <TARGET>Then, you can check for vulnerabilities.
sudo nmap --script "smb-vuln-*" -p139,445 <TARGET>Thanks to crackmapexec and valid credentials, you can obtain helpful information with the following options:
--sam
--lsa
--sessions
--loggedon-users
--disks
--local-groups
--pass-pol
--rid-brute
--shares
Finally, you can use enum4linux to gather even more information:
User enumeration
After executing the Nmap scan, you should check if it allows NULL, guest or anonymous login to check if shares are available.
Note: -N is for not prompting for a password.
With crackmapexec this can be achieve with the following command.
rpcclient enumeration - port: 135
Thanks to rpcclient, you can obtain information about the domain, printers, groups and users.
RID CYCLING ATTACK
Enumerate users by brute-forcing the RID on the remote target.
Shares enumeration
Once checked that the attacker has access to the SMB service, it has to check the permissions for each share:
In case of read access, you can list the files of each share:
Finally, you can access a share to upload or download the files manually or recursively.
Alternatively, you can mount a share to explore it.
Netbios Enumeration- Port 139
LANMAN1 Error
On older hosts, you can encounter errors interacting with them. As a solution add client min protocol = LANMAN1 to GLOBAL setting in /etc/samba/smb.conf
Another alternative is using --option='client min protocol'=LANMAN1 with the smbclient command.
Last updated