Server Message Block (SMB) Enumeration, Attack and Defence

Introduction

If you see a service with TCP port 445 open, then it is probably running SMB. SMB is used for file sharing services. You will also see it related to other protocols in its operation:

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/06451bf2-578a-4b9d-94c0-8ce531bf14c4

Checklist

Here is a check list of common things to check:

• Can you enumerate the server version?
• Can you enumerate shares?
• What versions of the protocol are enabled?
• Can you connect using anon bind?
• Are there any known vulnerabilities?
• Can you enumerate usernames?
• Is SMB signing enabled?
• Are there other hosts in the subnet that can be used?

Read more “Server Message Block (SMB) Enumeration, Attack and Defence” →