2022 Developer Survey is open! Take survey.

Questions tagged [smb]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
user avatar
  • 1
0 votes
2 answers
45 views

How do AV interact with malicious executables in remote shares?

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish. Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
user avatar
0 votes
1 answer
238 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
user avatar
  • 79
1 vote
0 answers
123 views

Can SMB/CIFS credentials be extracted from Linux?

On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
user avatar
  • 79
1 vote
0 answers
104 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
user avatar
  • 11
0 votes
1 answer
2k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
user avatar
  • 15
1 vote
0 answers
116 views

Is SMB3-only Samba secure?

There's lots of "SMB is bad" parrotting online, and whenever I look closely, these claims are either unsubstantiated, or apply to unpached or misconfigured Windows servers or old versions of ...
user avatar
0 votes
1 answer
196 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
user avatar
1 vote
0 answers
109 views

Unknown NbtNS Traffic Leaving My PC

I was alarmed by the network monitoring team that there is some UDP traffic headed to the Internet on port 137 which was detected as SMB traffic by our monitoring solution. What is interesting is that ...
user avatar
  • 413
0 votes
1 answer
144 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
user avatar
  • 225
0 votes
2 answers
633 views

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB. Assuming that: My machine has no viruses in it (fresh Windows installation) It has been updated to the latest OS release I am ...
user avatar
4 votes
1 answer
821 views

SMBv1 Server vs Client relative vulnerability risk

IT support guy here (NOT security expert): I have several clients who currently have at least one legacy appliance that runs a Samba (or something like it) server using SMBv1, which cannot be upgraded ...
user avatar
0 votes
1 answer
201 views

Meterpreter pivot with a bind_named_pipe

I have a pivot setup on a compromised windows 10 box and am trying to get an SYSTEM shell on a separate machine in the target network. I have successfully done this abusing an unquoted service path ...
user avatar
  • 189
1 vote
2 answers
2k views

The security of an SMB port exposed to the internet

I have installed a Windows machine with update 1909 (build 18363.720 (March 2020) (On which I try to find vulnerabilities with nmap), which includes smb 3.1.1 with the latest fixed bugs. I created a ...
user avatar
0 votes
0 answers
196 views

Are metasploit exploits always Port specific (smb-samba)?

So I was trying a machine on vulnhub i found port 139 open and also found its service and version on nmap scan that was samba-4.3.11 i also ran auxiliary scan module to confirm the version and service ...
user avatar
1 vote
2 answers
1k views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
user avatar
  • 11
0 votes
0 answers
1k views

System Process PID 4 Attempt to connect to Public IP using port 445

I was cross checking my environment and i found that System process PID 4 establishing Outbound connection to public IP using Port 445 is that a normal behavior? OS: Windows 10 1909 System PID 4 ...
user avatar
3 votes
0 answers
136 views

smb iptables configuration not working with vpn killswitch

my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
user avatar
  • 31
1 vote
1 answer
234 views

Samba and verifying server identity

Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
user avatar
  • 13
0 votes
0 answers
189 views

ms08_067_netapi exploit & pivoting problem

I'm having troubles with ms08_067_netapi. I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
user avatar
  • 1
0 votes
1 answer
431 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
user avatar
1 vote
1 answer
1k views

Security risks of file shares vs ssh or sftp, in "backward" direction?

I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
user avatar
0 votes
2 answers
229 views

unauthorized devices appear in windows 10 network drive SMB [closed]

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
user avatar
0 votes
0 answers
489 views

How Responder exactly works?

I know how Responder works but I am a little bit confused regarding the attack. Responder runs on attacker's machine and waits for someone to type something wrong in Windows Explorer. For ex: instead ...
user avatar
4 votes
2 answers
321 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
user avatar
  • 2,033
1 vote
1 answer
272 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
user avatar
  • 331
0 votes
1 answer
3k views

Can SMBv1 be secure if used for just SMB server discovery?

I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
user avatar
  • 111
1 vote
1 answer
2k views

Is it possible to block psexec without blocking regular SMB access?

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but ...
user avatar
  • 95
0 votes
1 answer
800 views

My system is being attacked or it is attacking

My system is running on Windows 10. I am using Avast Free Antivirus. Today i got an update from Windows update. After installing that update Avast started raising notification saying We've safely ...
user avatar
0 votes
1 answer
119 views

Is it safe to install MS17-010 unpatched OS as guest on patched host?

For example, these are unpatched old OS. Windows 98 Windows 98 SE Windows ME Windows NT 4.0 Windows 2000 Given that SMBv1 is not disabled on host but already patched. Is the unpatched guest OS ...
user avatar
  • 101
2 votes
1 answer
2k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
user avatar
  • 133
2 votes
0 answers
414 views

SMB Session Hijacking

I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting. Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
user avatar
  • 61
0 votes
1 answer
2k views

How can I brute force an individual smb share?

I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares. - Windows XP Service Pack 3 (English) - IPC$ ...
user avatar
0 votes
1 answer
119 views

why am i unable to gain access to remote pc through smb while having correct credentials? [closed]

I have set up my ethical hacking and penetration lab. My host OS is Windows 10 and target 0S is Windows 7. I want to penetrate into Windows 7 from Windows 10 through SMB. When I try to penetrate, it ...
user avatar
9 votes
2 answers
1k views

What harm is there in obtaining password hashes in a Windows environment?

ArsTechnica posted this article recently talking about how the power grid has been penetrated: Hackers lie in wait after penetrating US and Europe power grid networks Excerpt: One tactic involved ...
user avatar
  • 967
3 votes
1 answer
418 views

SMBRelay Attack - Mount Share instead of Code Execution

Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
user avatar
  • 174
3 votes
0 answers
54 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
user avatar
  • 131
1 vote
2 answers
315 views

Firewall detects CVE 2017-0016

My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability ...
user avatar
  • 11
1 vote
0 answers
614 views

SMB/CIFS security in heterogeneous environment

Suppose I have several machines both Linux and Windows I want to connect to each other for file-sharing. Now I use mount -cifs command with vers=3.0 clause to access Windows shares from my Linux ...
user avatar
4 votes
1 answer
6k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
user avatar
  • 443
0 votes
1 answer
2k views

Internal Pen testing - Can't get SMB Relay attack to work?

Using Responder to capture NTLMv2 hashes on LAN using kali and relay them to the smbrelayx.py module from Impacket. I understand I have to change the config file in Responder to set the SMB and HTTP ...
user avatar
2 votes
1 answer
1k views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
user avatar
3 votes
2 answers
4k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
user avatar
-9 votes
2 answers
472 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
user avatar
  • 967
1 vote
3 answers
1k views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
user avatar
  • 967
2 votes
0 answers
627 views

Restrict SMBv1 on LAN while supporting v2/3

I have a network with several servers and I've disabled SMBv1 on every server except one because an office printer/scanner is used to scan documents to a shared folder over SMB. The printer is only ...
user avatar
4 votes
1 answer
955 views

How to check if Windows computer has SMB accessible over the internet?

The currently spreading ransomware WannaCry exploits SMB vulnerabilities to infect new computer. Is this exploitation possible over the internet? How to check if my computer has SMB accessible ...
user avatar
  • 143
1 vote
0 answers
3k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
user avatar
5 votes
4 answers
20k views

Find SMBv1 status with Nmap

Is there a ready way with nmap's scripting option to find machines with SMB 1 still enabled server side? It'd be a whole lot faster for me to monitor my remediation if it is available. I'd rather ...
user avatar
  • 3,762
8 votes
3 answers
13k views

Is it risky to allow SMB traffic to the Internet

SMB is a well-known network file sharing protocol, and I assume it's supposed to be used internally only. At my company I found someone connecting to a share on a server on the Internet over port 445 ...
user avatar