SMB is the Server Message Block protocol, serving Windows (and Samba) file shares on TCP 445, and it is central to Windows environments: file shares, the SYSVOL/NETLOGON domain shares, named pipes for RPC, and administrative shares (C$, ADMIN$) all ride on it. Offensively it is one of the richest services on a network. The surface spans how a session is established (anonymous null sessions, guest access, or credentials), enumerating shares and the per-identity access to them, looting readable shares and poisoning writable ones to capture credentials or plant code, the message-signing and NTLM-relay weaknesses that turn authentication into lateral movement, and the protocol implementation's own remote code execution bugs.
# fingerprint and reach the service
nmap -p445 --script smb-protocols,smb2-security-mode <target>
nxc smb <target> # OS, domain, signing, SMBv1 status
Subtopics#
- Share enumeration: listing shares and per-identity access.
- Null session: anonymous access to shares and RPC.
- Signing and relay: SMB signing weaknesses and NTLM relay.
- Loot and sensitive files: mining readable shares.
- Writable share poisoning: planting payloads and coercion files.
- Known SMB exploits: the protocol's remote code execution flaws.