nmap -sS -sV -p445 -T4 $IP
nmap -p445 --script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-services.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse $IP
nbtscan -r 192.168.1.0/24
sudo nmap -p445 -sS --script="smb-enum*" $IP
Si user du domaine/local
nmap -p445 --script=smb-enum-* --script-args smbuser=xx,smbpassword=xx $IP
enum4linux -a $IP | tee report.txt
#Dump interesting information
enum4linux -a [-u "<username>" -p "<passwd>"] <IP>
-umsf> use auxiliary/scanner/smb/smb_version
msf> use auxiliary/scanner/smb/smb_enumshares
msf> use auxiliary/scanner/smb/smb_enumusers
# List shares
smbclient --list //$IP
smbmap -H $IP
netexec smb 10.10.176.204 -u '' -p '' --shares
enum4linux -a $IP
enum4linux-ng -A -R -u user -p pass -v $IP # -R enumérer users via RID cycling
nmap --script smb-enum-shares -p 139,445 -T4 -Pn $IP
smbng --host $IP -u ' ' --no-pass #(puis taper shares)
# List shares (implicit null creds)
smbclient --no-pass --list //$IP
# List shares (explicit null creds)
smbclient --user ''%'' --list //$IP
smbmap -u '' -p '' -H $IP
# Open an interactive session to operate on a specific share
smbclient "//$IP/$SHARE_NAME"
rpcclient -U "" -N 192.187.31.3 #no creds
>srvinfo
>enumdomusers
>enumdomgroups
rpcclient -U "username%passwd" <IP> #With creds
Brute Force