139, 445 - SMB

Nmap

nmap -v -p 139,445 $targetip-254 -oG smb.txt 

search for nmap NSE scripts

ls -1 /usr/share/nmap/scripts/smb*
    /usr/share/nmap/scripts/smb2-capabilities.nse
    /usr/share/nmap/scripts/smb2-security-mode.nse
    /usr/share/nmap/scripts/smb2-time.nse
    ...

Nmap NSE script

nmap --script "safe or smb-enum-*" -p 139,445 $targetip

Note: NSE SMB enumeration scripts:

• smb-enum-domains
• smb-enum-groups
• smb-enum-processes
• smb-enum-services
• smb-enum-sessions
• smb-enum-shares
• smb-enum-users

nmap -v -p 139, 445 --script=smb-os-discovery $targetip-254

Unsafe option. scripts will crash the vulnerable system:

nmap -v -p 139,445 --script=smb-vuln-ms08-067 --script-args=unsafe=1 $targetip

Search for known vulnerabilities:

nmap --script smb-vuln* -p 139,445 -oN smb-vuln-scan $targetip

Nbtscan

nbtscan -r $targetip/24

SMB/RPC inventory: enum4linux-ng

Use enum4linux-ng for users/groups/shares/policy inventory:

enum4linux-ng -As -oA smb-anonymous TARGET

Read smb-anonymous.json/.yaml and failed/skipped sections. -As skips NetBIOS-name lookup and does not include RID cycling or detailed group membership. A denied read differs from an empty result. Skip a repeated anonymous pass if AutoRecon already returned the needed inventory.

enum4linux-ng -As -u USER -p 'PASSWORD' -w DOMAIN -oA smb-authenticated TARGET

enum4linux-ng -Gm -oA smb-group-members TARGET
enum4linux-ng -R -r 500-550,1000-1050 -oA smb-rid TARGET

enum4linux-ng -S -s /PATH/shares.txt -oA smb-share-names TARGET

Keep smbclient for browsing/downloading files, smbmap for a focused recursive permission view, and protocol-specific authenticated access checks below. A metadata inventory does not replace these functions or turn successful authentication into administrator access.

Existing-ticket SMB inventory

Use a valid existing cache, working domain DNS/time and the intended service hostname:

export KRB5CCNAME=/PATH/identity.ccache
nxc smb HOST_FQDN --use-kcache --shares --pass-pol

Read the actual authenticated identity and each returned/denied operation, not just the exit code. Missing/expired cache, wrong hostname/SPN, missing route, DNS failure or KRB_AP_ERR_SKEW requires fixing that prerequisite before retrying. Avoid unnecessary sudo that loses the cache environment. NetExec Kerberos usage.

Domain users/groups belong to LDAP inventory; newer NetExec versions report removed SMB domain-enumeration arguments. The warning is not an empty-directory finding. Password/hash/local-account forms below and other lateral-movement transports remain distinct contexts.

Smbclient / smbmap / NetExec

List shared folders

It is always recommended to look if you can access to anything, if you don't have credentials try using null credentials/guest user.

smbclient --no-pass -L //$targetip # Null user
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //$targetip #If you omit the pwd, it will be prompted. With --pw-nt-hash, the pwd provided is the NT hash

smbmap -H $targetip [-P <PORT>] #Null user
smbmap -u "username" -p "password" -H $targetip [-P <PORT>] #Creds
smbmap -u "username" -p "<NT>:<LM>" -H $targetip [-P <PORT>] #Pass-the-Hash
smbmap -R -u "username" -p "password" -H $targetip [-P <PORT>] #Recursive list

nxc smb TARGET -u '' -p '' --shares --no-admin-check
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-admin-check
nxc smb TARGET -d DOMAIN -u USER -H HASH --shares --no-admin-check
nxc smb TARGET --local-auth -u USER -p 'PASSWORD' --shares --no-admin-check

For current NetExec whose nxc smb --help documents --file-write-check, leave that flag off: --shares uses directory listing and access-mask opens of existing share roots. It does not create files in this mode. WRITE (ACL) means an access-right probe succeeded, not that the ACL was changed or file creation succeeded. --no-admin-check skips the separate Service Control Manager permission probe. Local logs and NetExec's credential database still contain private data.

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares --no-write-check

NetExec replaces CrackMapExec's overlapping SMB login/share checks here. Password, NT hash and local-account contexts are retained; successful authentication alone does not imply guest access or remote execution. Ticket-cache authentication is a separate context; it does not replace these forms. NetExec upstream.

Connect/List a shared folder

#Connect using smbclient
smbclient --no-pass \\\\$targetip\\<Folder>
smbclient -U 'username[%passwd]' -L [--pw-nt-hash] //$targetip 
#If you omit the pwd, will be asked. 
#With --pw-nt-hash, the pwd provided is the NT hash
#Use --no-pass -c 'recurse;ls'  to list recursively with smbclient

#List with smbmap, without folder it list everything
smbmap [-u "username" -p "password"] -R [Folder] -H $targetip [-P <PORT>] # Recursive list
smbmap [-u "username" -p "password"] -r [Folder] -H $targetip [-P <PORT>] # Non-Recursive list
smbmap -u "username" -p "<NT>:<LM>" [-r/-R] [Folder] -H $targetip [-P <PORT>] #Pass-the-Hash

Mount Shares

mount -t cifs -o username=user,password=password //$targetip/Share /mnt/share

Download Files

Create a tar file of the files under users/docs.

smbclient //$targetip/Share "" -N -Tc backup.tar users/docs

Possible Errors

SMB Protocol Negotiation Failed

Normally SMB takes care of choosing the appropriate protocol for each connection. However, if the offered protocols are out of client’s default range, it will return an error message like this:

Protocol negotiation failed: NT_STATUS_IO_TIMEOUT

Solution

For an evidenced legacy protocol mismatch, prepare the isolated Samba client profile, then select it for this check only:

smbclient -s "$HOME/oscp/tools/config/smb-legacy.conf" -L //TARGET -U 'DOMAIN/USER'

The command prompts for the password. Leave global client settings unchanged; negotiation failure, authentication failure and share authorization are different outcomes.

Prepare tools used on this page

Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.

sudo apt install enum4linux-ng

enum4linux-ng -h

sudo apt install smbclient samba-common-bin
mkdir -p "$HOME/oscp/tools/config"
( set -o noclobber
cat > "$HOME/oscp/tools/config/smb-legacy.conf" <<'EOF'
[global]
client min protocol = NT1
client max protocol = SMB3
EOF
)
testparm -s "$HOME/oscp/tools/config/smb-legacy.conf"