> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/enumeration/smb-enumeration-cheat-sheet.md).

# SMB Enumeration Cheat Sheet

#### SMB Enumeration Cheatsheet

1. **Discover SMB Services**:
   * Nmap: `nmap -p 139,445 -oN smb-scan.txt <target>`
   * Netdiscover: `netdiscover -i <interface> -r <IP range>` (if you need to find SMB servers on your local network)
2. **Enumerate SMB Shares**:
   * SMBClient: `smbclient -L //<target>`
   * smbclient (anonymous login): `smbclient -L //<target> -N`
   * Enum4linux: `enum4linux -a <target>`
3. **Access SMB Shares**:
   * SMBClient: `smbclient //<target>/<share>`
   * Mount with CIFS: `mount -t cifs -o username=<username> //<target>/<share> /mnt/smb`
4. **Brute Force Authentication**:
   * Hydra: `hydra -L users.txt -P passwords.txt smb://<target>`
   * CrackMapExec (CME): `cme smb <target> -u users.txt -p passwords.txt`
5. **Check for Null Sessions**:
   * SMBClient: `smbclient -L //<target> -U ""`
   * Rpcclient: `rpcclient -U "" <target>`
6. **Enumerate Users**:
   * Enum4linux: `enum4linux -u <username> -p <password> -i <target>`
   * SMBClient: `smbclient -U <username>%<password> //<target>/IPC$`
7. **Exploiting Weak Configurations**:
   * Null Sessions: Check for open shares, especially IPC$, to view sensitive info.
8. **Exploiting Vulnerabilities**:
   * Vulnerability Scanners (e.g., Nessus, OpenVAS): Scan for SMB-related vulnerabilities.
   * Metasploit: Use Metasploit modules for SMB exploitation.
9. **Pass the Hash (PtH) Attack**:
   * Impacket: `pth-winexe -U <username>%<hash> //<target> cmd.exe`
   * CrackMapExec: `cme smb <target> -u <username> -H <hash>`
10. **Data Exfiltration/Upload/Download**:
    * SMBClient: Use `smbclient` to upload or download files.
    * Mount with CIFS: Mount SMB shares to transfer files.
11. **Post-Exploitation**:
    * PowerShell Empire: Use Empire modules for post-exploitation.
    * Meterpreter: Use Metasploit Meterpreter sessions for Windows post-exploitation.
12. **Logging and Stealth**:
    * Consider using tools that maintain stealth during enumeration and exploitation.
13. **Cleanup**:
    * After enumeration or exploitation, it's essential to clean up your tracks and remove any lingering artifacts.

### Enumerating SMB with a bad username

```
smbmap -H 10.10.10.134 -u df
```

### Recursively grabbing files using SMBclient and mget

```
smbclient //<server_ip>/<share_name> -U <username>%<password>
recurse on
cd <remote_directory>
mget *
```

### Using the mount command

```
mount -t cifs //10.10.10.134/backups /mnt -o user=,password=
```

1. `mount`: This is the Linux command used to mount file systems, including network shares like SMB shares.
2. `-t cifs`: This option specifies the file system type to be mounted. In this case, it's set to "cifs" to indicate that the CIFS (Common Internet File System) protocol should be used.
3. `//10.10.10.134/backups`: This is the source of the remote SMB share you want to mount. It consists of two parts:
   * `//`: Indicates the beginning of an SMB share path.
   * `10.10.10.134/backups`: Specifies the IP address (or hostname) of the remote server where the SMB share is hosted and the share name ("backups").
4. `/mnt`: This is the local directory where you want to mount the SMB share. In this case, the share will be accessible under the `/mnt` directory on your local system.
5. `-o user=,password=`: This part of the command specifies options for the mount. It includes the following options:
   * `user=`: This option is used to specify the username that should be used to authenticate to the SMB share. Replace `<username>` with the actual username you want to use for authentication. In your provided command, the username is empty (which might be intended if you plan to provide the username interactively).
   * `password=`: This option is used to specify the password for the specified username. Replace `<password>` with the actual password for authentication. Similarly, the password is empty in your provided command.

### Enumerating SMB with Crackmapexec

```
crackmapexec smb 10.10.10.192 --shares -u 'ddrt' -p ''
```

### Using SMBcacls to list share permissions

```
smbcacls -N '//10.10.10.103/Department Shares' /Users
```