SMB enumeration starts with reachability, signing, authentication behavior, shares, sessions, and RPC. We do not execute commands until we know what account we have, where it is admin, and what shares are readable or writable.
Variables
export DOMAIN=ootw.local
export DC=10.10.10.200
export TARGET=10.10.10.201
export USER=student
export PASS='student'
Port scan
nmap -p 139,445 -sV --script smb-protocols,smb2-security-mode,smb2-time $TARGET
nmap -p 445 --script smb-os-discovery,smb-enum-shares,smb-enum-users $TARGET
NetExec probe
nxc smb 10.10.10.0/24
nxc smb $TARGET -u "$USER" -p "$PASS"
nxc smb $TARGET -u "$USER" -p "$PASS" --shares
nxc smb $TARGET -u "$USER" -p "$PASS" --sessions
nxc smb $TARGET -u "$USER" -p "$PASS" --loggedon-users
nxc smb $TARGET -u "$USER" -p "$PASS" --pass-pol
Signing and relay list
nxc smb 10.10.10.0/24 --gen-relay-list smb-relay-targets.txt
cat smb-relay-targets.txt
Null and guest checks
smbclient -N -L //$TARGET
smbmap -H $TARGET -u '' -p ''
smbmap -H $TARGET -u guest -p ''
nxc smb $TARGET -u '' -p '' --shares
nxc smb $TARGET -u guest -p '' --shares
enum4linux-ng -A $TARGET
smbclient
smbclient -L //$TARGET -U "$DOMAIN\\$USER%$PASS"
smbclient //$TARGET/SYSVOL -U "$DOMAIN\\$USER%$PASS" -c "ls"
smbclient //$TARGET/NETLOGON -U "$DOMAIN\\$USER%$PASS" -c "ls"
smbmap
smbmap -H $TARGET -d $DOMAIN -u "$USER" -p "$PASS"
smbmap -H $TARGET -d $DOMAIN -u "$USER" -p "$PASS" -r
smbmap -H $TARGET -d $DOMAIN -u "$USER" -p "$PASS" -R SYSVOL --dir-only
RPC
rpcclient -U "$DOMAIN\\$USER%$PASS" $TARGET -c "srvinfo"
rpcclient -U "$DOMAIN\\$USER%$PASS" $TARGET -c "getdompwinfo"
rpcclient -U "$DOMAIN\\$USER%$PASS" $TARGET -c "enumdomusers"
rpcclient -U "$DOMAIN\\$USER%$PASS" $TARGET -c "enumdomgroups"
rpcclient -U "$DOMAIN\\$USER%$PASS" $TARGET -c "netshareenumall"
Windows
net view \\dc01.ootw.local /all
net view \\10.10.10.200 /all
dir \\dc01.ootw.local\SYSVOL
dir \\dc01.ootw.local\NETLOGON
PowerShell
Get-SmbConnection
Get-SmbShare
Get-SmbShareAccess -Name SYSVOL
Test-NetConnection 10.10.10.200 -Port 445