SMB Enumeration
The security track record of the Server Message Block protocol
has been poor for many years due to its complex implementation and open nature.
From unauthenticated SMB null sessions in Windows 2000 and XP,
to a plethora of SMB bugs and vulnerabilities over the years,
SMB has had its fair share of action.
Keeping this in mind, the SMB protocol has also been updated and improved in parallel
with Windows releases.
The NetBIOS service listens on TCP port 139, as well as several UDP ports.
It should be noted that SMB, TCP port 445, and NetBIOS are two separate protocols.
NetBIOS is an independent session layer protocol and service that allows computers
on a local network to communicate with each other.
While modern implementations of SMB can work without NetBIOS,
NetBIOS over TCP is required for backward compatibility
and these are often enabled together.
This also means the enumeration of these two services often goes hand-in-hand.
These services can be scanned with tools like nmap.
We saved the scan output into a text file,
which revealed hosts with ports 139 and 445 open.
There are other, more specialized tools for specifically identifying NetBIOS
information, such as nbtscan.
We can use this to query the NetBIOS name service for valid NetBIOS names,
specifying the originating UDP port as 137 with the -r option.
The scan revealed two NetBIOS names belonging to two hosts.
This kind of information can be used to further improve the context
of the scanned hosts, as NetBIOS names are often very descriptive about the role
of the host within the organization.
This data can feed our information-gathering cycle
by leading to further disclosures.
Nmap also offers many useful NSE scripts that we can use to discover
and enumerate SMB services.
We’ve located several interesting Nmap SMB NSE scripts that perform
various tasks such as OS discovery and enumeration via SMB.
Let’s try the smb-os-discovery module on the Windows 11 client.
This particular script identified a potential match for
the host operating system; however, we know it’s inaccurate as the target host
is running Windows 11 instead of the reported Windows 10.
Unlike Nmap’s OS fingerprinting options we explored earlier,
OS enumeration via NSE scripting provides extra information,
such as the domain and other details related to
Active Directory Domain Services.
This approach will also likely go unnoticed,
as it produces less traffic that can also blend into normal enterprise
network activity.
Having discussed SMB enumeration via Kali,
let’s learn how to enumerate it from a Windows client.
One useful tool for enumerating SMB shares within Windows environments is net view.
It lists domains, resources, and computers belonging to a given host.
As an example, connected to the client01 VM,
we can list all the shares running on dc01.
By providing the /all keyword,
we can list the administrative shares ending with the dollar sign.