SMB — Hub

What is SMB?

Server Message Block (SMB) is a network file-sharing protocol used by Windows for sharing files, printers, and named pipes across a network. It runs over TCP and is one of the most commonly attacked services in a Windows environment.

OSCP relevance: SMB is almost always present on Windows targets. It enables file share access, user enumeration, relay attacks, credential dumping, and lateral movement.

Ports

SMB Versions

Quick Enumeration Flow

1. Nmap scan — confirm ports 139/445 open, grab version banner
2. Anonymous / null session test — can you list shares without creds?
3. Enumerate shares — what shares exist? what can you access?
4. Enumerate users / groups — via RPC or SMB
5. Check for known vulns — EternalBlue, PrintNightmare, etc.
6. Authenticated access — use creds to read/write shares, exec commands

1. Nmap — Initial SMB Recon

# Version + default SMB scripts
nmap -p 139,445 -sV --script smb-security-mode,smb2-security-mode,smb-os-discovery 10.10.10.10
 
# Full SMB script suite
nmap -p 139,445 --script smb-enum-shares,smb-enum-users,smb-vuln* 10.10.10.10
 
# Check for EternalBlue specifically
nmap -p 445 --script smb-vuln-ms17-010 10.10.10.10
 
# SMB signing check (important for relay attacks)
nmap -p 445 --script smb2-security-mode 10.10.10.10

2. Null / Anonymous Session

A null session uses no username or password — works on older or misconfigured systems:

smbclient -L //10.10.10.10 -N           # List shares anonymously
smbmap -H 10.10.10.10                   # Map shares, show permissions
enum4linux -a 10.10.10.10               # Full anonymous enumeration
crackmapexec smb 10.10.10.10            # Quick banner + signing info

Sub-Notes (This Folder)

Related Tools — Impacket (Separate Folder)

Related Tools (Outside This Folder)

Common Attack Paths

Related Tools

• smbclient
• smbmap
• enum4linux
• CrackMapExec - nxc
• Impacket
• Responder

Related Notes

• Tools
• Networking
• AD
• Impacket
• Responder
• Initial foothold
• LatMovement
• Windows PrivEsc
• Nmap
• Hydra
• MetaSploit
• Auxiliary
• Training