I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares.
- Windows XP Service Pack 3 (English)
- IPC$ - (I) Remote IPC
- Documents - (DS)
- ADMIN$ - (DS) Remote Admin
- C$ - (DS) Default share
I am trying to access the shares marked with a $
which are private and non accessible. I have tried using the smb_login
, but as I am unable to specific an individual share from that list to target for a brute force scan, each time I try the scan finishes immediately with a message that the Documents share is anonymous, thus the brute force checking is useless (I understand why this is the case)
When I use smbclient
to access the private shares, I am prompted for a password (which I don't have, hence the brute forcing). So my question is: Can I use smb_login or some other tool (preferably available on Linux) to brute force a particular share (eg ADMIN$
)?