While security testing an SMB network, I use the following commands with AD username and password credentials to perform audits on shares from within a Linux environment.
SMBHOST='' SMBUSER='' SMBPASS='' SHAREDIR='C$' MOUNTDIR=mnt/smb/"$SMBHOST"/"$SHAREDIR" mkdir -p "$MOUNTDIR"; mount -t cifs -o ro,vers='2.0',user="$SMBUSER",password="$SMBPASS" \ //"$SMBHOST"/"$SHAREDIR" "$MOUNTDIR" --verbose;
There are sometimes instances where I have NTLM hashes (e.g. as a result of SAM dumps) but no plain text password. Is it possible to mount a CIFS share in a local directory by passing the hash?