Questions tagged [smb]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
56 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
1
vote
1answer
96 views

Security risks of file shares vs ssh or sftp, in “backward” direction?

I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
0
votes
0answers
42 views

What are legitimate case of smb and netbios communication?

Please can any one help me to understand what are the legitimate case to observing the netbios and smb communication between two machine in the same network? (when I see my logs I confronts with ...
0
votes
2answers
117 views

unauthorized devices appear in windows 10 network drive SMB [closed]

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
0
votes
0answers
42 views

Files Accessed over macOS's SMB Sharing Encryption

I have an iMac on the same network as my Windows desktop. Both are on the local network at my university. I am sharing a folder on the iMac using the built-in sharing utility (via SMB) with everyone ...
0
votes
0answers
77 views

How Responder exactly works?

I know how Responder works but I am a little bit confused regarding the attack. Responder runs on attacker's machine and waits for someone to type something wrong in Windows Explorer. For ex: instead ...
4
votes
2answers
132 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
1
vote
1answer
98 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
0
votes
1answer
1k views

Can SMBv1 be secure if used for just SMB server discovery?

I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
1
vote
1answer
414 views

Is it possible to block psexec without blocking regular SMB access?

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but ...
0
votes
1answer
446 views

My system is being attacked or it is attacking

My system is running on Windows 10. I am using Avast Free Antivirus. Today i got an update from Windows update. After installing that update Avast started raising notification saying We've safely ...
0
votes
0answers
662 views

mount CIFS shares on Linux by passing the hash

While security testing an SMB network, I use the following commands with AD username and password credentials to perform audits on shares from within a Linux environment. SMBHOST='' SMBUSER=...
0
votes
1answer
75 views

Is it safe to install MS17-010 unpatched OS as guest on patched host?

For example, these are unpatched old OS. Windows 98 Windows 98 SE Windows ME Windows NT 4.0 Windows 2000 Given that SMBv1 is not disabled on host but already patched. Is the unpatched guest OS ...
2
votes
1answer
1k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
2
votes
0answers
202 views

SMB Session Hijacking

I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting. Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
0
votes
1answer
1k views

How can I brute force an individual smb share?

I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares. - Windows XP Service Pack 3 (English) - IPC$ ...
0
votes
1answer
75 views

why am i unable to gain access to remote pc through smb while having correct credentials? [closed]

I have set up my ethical hacking and penetration lab. My host OS is Windows 10 and target 0S is Windows 7. I want to penetrate into Windows 7 from Windows 10 through SMB. When I try to penetrate, it ...
8
votes
2answers
1k views

What harm is there in obtaining password hashes in a Windows environment?

ArsTechnica posted this article recently talking about how the power grid has been penetrated: Hackers lie in wait after penetrating US and Europe power grid networks Excerpt: One tactic involved ...
2
votes
1answer
282 views

SMBRelay Attack - Mount Share instead of Code Execution

Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
3
votes
0answers
53 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
1
vote
2answers
129 views

Firewall detects CVE 2017-0016

My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability ...
1
vote
0answers
420 views

SMB/CIFS security in heterogeneous environment

Suppose I have several machines both Linux and Windows I want to connect to each other for file-sharing. Now I use mount -cifs command with vers=3.0 clause to access Windows shares from my Linux ...
4
votes
1answer
1k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
0
votes
1answer
370 views

Internal Pen testing - Can't get SMB Relay attack to work?

Using Responder to capture NTLMv2 hashes on LAN using kali and relay them to the smbrelayx.py module from Impacket. I understand I have to change the config file in Responder to set the SMB and HTTP ...
2
votes
1answer
742 views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
2
votes
2answers
2k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
-9
votes
2answers
394 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
1
vote
3answers
943 views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
1
vote
0answers
468 views

Restrict SMBv1 on LAN while supporting v2/3

I have a network with several servers and I've disabled SMBv1 on every server except one because an office printer/scanner is used to scan documents to a shared folder over SMB. The printer is only ...
4
votes
1answer
676 views

How to check if Windows computer has SMB accessible over the internet?

The currently spreading ransomware WannaCry exploits SMB vulnerabilities to infect new computer. Is this exploitation possible over the internet? How to check if my computer has SMB accessible ...
1
vote
0answers
1k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
5
votes
3answers
15k views

Find SMBv1 status with Nmap

Is there a ready way with nmap's scripting option to find machines with SMB 1 still enabled server side? It'd be a whole lot faster for me to monitor my remediation if it is available. I'd rather ...
6
votes
3answers
8k views

Is it risky to allow SMB traffic to the Internet

SMB is a well-known network file sharing protocol, and I assume it's supposed to be used internally only. At my company I found someone connecting to a share on a server on the Internet over port 445 ...
1
vote
1answer
315 views

penetration testing: NBNS response on different network

I have a (test) setup where I want to respond to NBNS broadcasts. The clients sending out the broadcasts are on a different network. I can sniff the traffic using a pivot host on this network. So far ...
5
votes
1answer
368 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
2
votes
1answer
1k views

How SMB signing works? [closed]

SMB signing is used to prevent illegitimate modification on SMB packets. It is also used to prevent attacks like SMB relay. There is not much documentation on SMB signing. The only thing I understand ...
0
votes
1answer
1k views

Responder mitigation

The Responder tool can grab the netntlm hashes of clients on a Microsoft AD network by either using LLMNR to answer queries "accidentally" made by clients by responding as otherwise nonexistent SMB ...
0
votes
1answer
141 views

How to identify which SMB host can communicate one another? [closed]

I would like to know which hosts (on a local network) can communicate with one another. That is to say: who is the server? who can communicates with him? Is it all the hosts with ports 139 and 445 ...
1
vote
1answer
5k views

Responder SMBv2 and cracking

So, doing some testing after seeing a Responder tweet where SMBv2 is supported (https://twitter.com/PythonResponder/status/774236707847704576) and testing a scenario with Windows 7 SMB lookup for an ...
1
vote
3answers
475 views

Why am I unable to capture LM & LMHASH?

I'm running a simple test of Metasploit's auxiliary/server/capture/smb. It works, but both LMHASH & LM are empty [*] SMB Captured - 2016-09-27 16:49:31 +0800 NTLMv2 Response Captured from 172.16....