[ELECTRONIC NOISES]
The first service we want to introduce is SMB.
SMB is a Windows implementation of a file share.
And there's CIFS, which is the Common Internet File
System which is the generic term for it.
SMB stands for Server Message Block.
But they basically work the same.
Let's take a look.
We have a Windows machine, and we're in an ipconfig.
We have our IP address.
This is 10.4.20.56.
And we're on a subnet mask of 255.255.240.
So that's a CIDR 20 notation.
We're in a ren Nmap scan with that CIDR 20 looking for open
ports, and we came across this 10-4-17-133.
This is us in my ipconfig.
So in both situations, we see that we've
got 135, 139, and 445 open.
These are Windows machines.
And these are fairly common ports
to see open on a Windows machine.
3389 also gets us thinking this is a server over here.
So 445 is where SMB or CIFS hangs out.
NetBIOS used to be a bigger part of SMB
in older versions of Windows.
It still exists.
It's still used.
It usually sets up the session for SMB.
But if we run this scan looking for our service enumeration
and our operating system, then we
see for sure that this is Microsoft Windows Server 2008
R2 or 2012 running that version of SMB.
The operating system fingerprint didn't find anything.
But the service information tells us
that it's a Windows Server 2008 to 2012.
That's good enough for what we want
right now because really what we're showing is what SMB does.
We ran a scan with tack lowercase
s, uppercase C. This does the default scripts.
And it gathered some information for us.
Since it knew 3389 is open, it got the NetBIOS domain name
and computer name, which doesn't give us really
anything for this machine.
But it could be helpful for other machines.
Again, not anything too terribly useful-- some SMB OS discovery,
security modes, and time.
This is helpful SMB enumeration right there.
And we'll break this out in the future,
looking at this NBS stat, or NB stat, and more of the SMB Nmap
scans in the future.
But I just want to show you what SMB is.
The best way-- open up File Explorer.
We go to our network, and we will map a network drive.
Pick like a Z drive.
You might see this very often in an enterprise
system, in an office setting.
It's rarely in a home network.
But if we put in our IP address, this 10.4.17.133,
and then go to Browse, we can see that on the network
there's that machine.
And we'll go with the C drive, hit OK, and Finish.
And now we've got this on our computer, the Z drive which is
mapped to the C drive on 133.
We can go in and look at users, Bob.
And this is different than our own machine.
On our machine, the C drive users just looks like that.
And this is our Z drive.
Z drive matches to the C drive on 133.
Notice how they're different.
That is SMB in practice.
There are command line scripts for setting up and getting
rid of SMB.
The best way to really show that is I will put this over here.
I'll do new use star backslash delete.
Sorry, it's a flag, net use star forward delete.
Backslash, it's looking for a network.
And it's going to say, you're going
to remove these remote connections.
Do we want to do that?
Yes.
And force them closed?
Yes.
We see it is removed.
And that other window we had open disappeared as well.
We could reconnect it with the command.
Its net use.
We'll call the Z drive again, 10.4.17.133 C drive.
And this actually has a username and password.
smbserver_771 is the password.
And user is administrator.
And we see it is back.
And that's the basics of how SMB works.
Now, we'll get into some details about how
we can take advantage of SMB.
But that's the protocol in a nutshell.
I hope that was informative.
Let's see how else we can play with it.