Server Message Block

• SMB Enumeration

Windows supports file-and printer-sharing traffic using the SMB protocol directly hosted on TCP. In earlier OSs, SMB traffic required the NetBIOS over TCP (NBT) protocol to work on TCP/IP transport. Directly hosted SMB traffic uses port 445 (TCP and UDP) instead of NetBIOS.

References

• Enumerating SMB, RPC, and NetBIOS for Pentesting (Ports 445, 135-139)

Ports

Initially, it was designed to run on top of NetBIOS over TCP/IP (NBT) using,

• TCP port 139 and UDP ports 137 and 138.

• However, with Windows 2000, Microsoft added the option to run SMB directly over TCP/IP on port 445 without the extra NetBIOS layer.

• Samba is a Unix/Linux-based open-source implementation of the SMB protocol

Tools

• smbclient
• enum4linux
• smbmap

nmap

nmap 10.129.14.128 -sV -sC -p139,445

OS Discovery

nmap --script smb-os-discovery.nse -p445 10.10.10.40

Example

• We can see that it performs the TCP handshake each time it establishes a session orange boxes
• When looking at the source and destination ports blue box
• If we look at the green boxes, the info field tells us a bit about what is happening in the SMB communication
  • there are many errors

Exploits

• Remote Command Execution
• Extract Hashes from SAM Database
• Enumerating Logged-on Users
• Pass-the-Hash (PTH)