0

I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares.

- Windows XP Service Pack 3 (English)
- IPC$ - (I) Remote IPC
- Documents - (DS) 
- ADMIN$ - (DS) Remote Admin
- C$ - (DS) Default share

I am trying to access the shares marked with a $ which are private and non accessible. I have tried using the smb_login, but as I am unable to specific an individual share from that list to target for a brute force scan, each time I try the scan finishes immediately with a message that the Documents share is anonymous, thus the brute force checking is useless (I understand why this is the case)

When I use smbclient to access the private shares, I am prompted for a password (which I don't have, hence the brute forcing). So my question is: Can I use smb_login or some other tool (preferably available on Linux) to brute force a particular share (eg ADMIN$)?

Improve this question
5
  • If worst came to worst you could always script a brute force via smbclient.
    – Hector
    Nov 8, 2017 at 9:19
  • Yeah I have considered that option @Hector in this particular case I was able to use rdp with Hydra as an alternative bruteforce of this machine but would be interesting to know still. Thanks for the suggestion!
    – Stringers
    Nov 8, 2017 at 9:54
  • hydra can do that, which is probably the answer to this question. So I'm voting to close as product recommendation.
    – Tobi Nary
    Nov 8, 2017 at 10:34
  • Additionally, have you tried to sniff traffic off of that machine? Maybe you can grab an old SMB hash and john that or PTH? CTFs usually require little brute force.
    – Tobi Nary
    Nov 8, 2017 at 10:37
  • I did have a look at Hydra but I couldn't seem to find the options to select a share but I will have another look. Just to clarify: Hydra has the ability to not only select a server to bruteforce using the SMB protocol, but also the specific share?
    – Stringers
    Nov 9, 2017 at 3:05

1 Answer 1

Reset to default
-2

The share access uses the SMB protocol, if you want to access these private shares you need to have the correct credentials.

I know that if your client is Windows , Anonymous credentials is passed if the current (yours) credentials does not has the permissions.

Linux by default is running Samba and there is one more product called NQE that is installed on a lot of machines, and i think these product are doing the same algorithm.

Summery: Over SMB i don't think you can access these share, the SMB protocol protect this kind of "attacks" Maybe you can try to access via NFS.

Improve this answer
1
  • This is borderline not an answer but an uneducated, lengthy comment.
    – Tobi Nary
    Nov 8, 2017 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .