Skip to content

03. SMB SMBMap

1. Checking SMB Protocol Versions

Command:

nmap -p 445 --script smb-protocols <IP Address>

Explanation:

  • Detects SMB versions supported by the target (SMBv1, SMBv2, SMBv3).
  • SMBv1 is known to be vulnerable to exploits like EternalBlue (MS17-010).

Example Output:

Host script results:
| smb-protocols:
|   dialects:
|     2.02
|     2.10
|     3.00

Real-World Use Case:

  • If SMBv1 is enabled, the system may be vulnerable to ransomware attacks like WannaCry.

2. Checking SMB Security Mode

Command:

nmap -p 445 --script smb-security-mode <target>

Explanation:

  • Identifies authentication methods and encryption levels enforced by the SMB server.

Example Output:

| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported

Real-World Use Case:

  • Determines whether weak authentication mechanisms are in place, potentially allowing unauthorized access.

3. Enumerating Active SMB Sessions

Command:

nmap -p 445 --script smb-enum-sessions <target>

Explanation:

  • Lists active SMB sessions on the target system.
  • Useful for identifying logged-in users and potential unauthorized connections.

Example Output:

| smb-enum-sessions:
|   Users logged in:
|     Administrator

Real-World Use Case:

  • Helps security analysts detect unauthorized access to SMB services.

4. Enumerating SMB Shares

Command:

nmap -p 445 --script smb-enum-shares <target>

Explanation:

  • Lists shared folders available on the target system.

Example Output:

| smb-enum-shares:
|   ADMIN$
|   C$
|   IPC$

Real-World Use Case:

  • Reveals accessible shared folders that may contain sensitive data.
  • Attackers can exploit misconfigured shares to access files without authentication.

5. Enumerating SMB Users

Command:

nmap -p 445 --script smb-enum-users --script-args smbusername=administrator,smbpassword=smbserver_771 <target>

Explanation:

  • Lists SMB users on the system.

Example Output:

| smb-enum-users:
|   Users:
|     Administrator
|     Guest

Real-World Use Case:

  • Identifies user accounts that might be targeted for brute-force attacks.

6. Enumerating SMB Domains

Command:

nmap -p 445 --script smb-enum-domains --script-args smbusername=administrator,smbpassword=smbserver_771 <target>

Explanation:

  • Lists domain names associated with the SMB server.

Real-World Use Case:

  • Useful in Active Directory penetration testing.

7. Enumerating SMB Groups

Command:

nmap -p 445 --script smb-enum-groups --script-args smbusername=administrator,smbpassword=smbserver_771 <target>

Explanation:

  • Retrieves information about security groups configured on the SMB server.

8. SMB Enumeration Using SMBMap

Checking Anonymous SMB Access

smbmap -u guest -p "" -d . -H <IP Address>
  • Attempts to list SMB shares without authentication.

Authenticating as Administrator

smbmap -u administrator -p smbserver_771 -d . -H <IP Address>
  • Uses valid credentials to list SMB shares.

Running Remote Commands

smbmap -H <IP Address> -u administrator -p smbserver_771 -x 'ipconfig'
  • Executes system commands remotely over SMB.

Real-World Use Case:

  • Used by attackers to run malicious commands on a compromised machine.

Listing Shared Files and Directories

smbmap -H <IP Address> -u administrator -p smbserver_771 -L
  • Lists all available SMB shares on the target.

Recursively Listing Files in C$ Share

smbmap -H <IP Address> -u administrator -p smbserver_771 -r 'C$'
  • Displays files inside the C$ (Admin Share).

Uploading a File to SMB Share

smbmap -H <IP Address> -u administrator -p smbserver_771 --upload '/root/flag.txt' 'C$\flag.txt'
  • Transfers flag.txt to the C$ share.

Real-World Use Case:

  • Attackers use this technique to drop malware onto the target system.

Downloading a File from SMB Share

smbmap -H <IP Address> -u administrator -p smbserver_771 --download 'C$\flag.txt'
  • Retrieves flag.txt from the C$ share.

Real-World Use Case:

  • Used for exfiltrating sensitive files.

Summary

These Nmap scripts and smbmap commands provide valuable insights into SMB security, misconfigurations, and potential attack vectors. Properly securing SMB services can help prevent unauthorized access, data leaks, and network intrusions.

Mitigation Strategies:

  1. Disable SMBv1 – Prevents exploitation via known vulnerabilities.
  2. Restrict Anonymous Access – Ensures only authenticated users can access SMB shares.
  3. Use Strong Credentials – Protects against brute-force attacks.
  4. Enable SMB Signing and Encryption – Prevents Man-in-the-Middle (MITM) attacks.
  5. Monitor SMB Logs – Detects suspicious activity in real time.

By applying these security measures, organizations can strengthen their SMB configurations and minimize risks.