Overview of SMB Enumeration in a Nutshell

Introduction

As penetration testers we need to understand what SMB is and its purpose

SMB which stands for Server Message Block is a file sharing protocol utilized for sharing resources and it also provides shared access to files, directories and printers across a network. SMB is mainly used by windows to connect computers together but it is also built-in operating systems such as Linux OS and macOS, to use it in Unix-based systems we can use Samba which enables the systems to communicate with windows machines in a network.

Versions of the SMB protocol

There are multiple versions of the SMB protocol and the purpose of these versions is to ensure that it is secure and meets the evolving network requirements. The versions of SMB protocols are:

• SMBv1: This was the first version of SMB and it was released in 1983 as a file sharing protocol for DOS. Within time, Microsoft began using it in their operating systems as a protocol for sharing access to files on a network.
• SMBv2: This version of the protocol was released by Microsoft in 2006 with Windows Vista and Windows Server 2008. This updated protocol enabled other Microsoft operating systems to interoperate.
• SMBv2.1: This version of the protocol was introduced with Windows 7 and Windows Server 2008, it had further performance improvements.
• SMBv3: This version of the protocol was released by Microsoft with the Windows 8 and Windows Server 2012. it had many changes that improved the SMB2, including enhanced security, added a new AES based signing algorithm,and the introduction of end-to-end encryption.
• SMBv3.02: This version of the protocol was introduced with the Windows 8.1, the main feature of this version is that it disabled the SMBv1 due to it being insecure.
• SMBv3.1.1: Introduced with Windows 10 and Windows Server 2016, this version of the SMB is the latest. It provides protection against MITM (Man-in-the-middle) attack. In addition, it supports AES-128 GCM encryption.

Is the SMB protocol secure?

While the SMB protocol is secure in modern implementations, older versions contain vulnerabilities. For instance, SMBv1 does not provide any encryption methods, making it susceptible to exploitation by hackers.

What are the tools used to enumerate SMB?

When we want to enumerate SMB we should know that SMB is a protocol that runs on port 445 or port 139. These ports are used for SMB communication. Additionally, There are various tools that are used by penetration testers to enumerate SMB services.

We will mention some of these tools and their basic usages:

SMBMap

SMBMap is a powerful tool that enumerates samba shares. it is capable of listing share drives, share contents, upload/downloads functionality, and even execute remote commands.

We can connect to an IP through SMB using credentials with the following command:

smbmap -u [username] -p [password] -d [domain] -H [ip or hostname]

To list shares:

smbmap -H [ip or hostname]

SMBclient

SMBclient is a command-line tool that allows users to interact with SMB/CIFS shares. It supports many features, such as ways to connect and manage shared resources on a remote system.

Connecting to a share (The user needs to enter a password):

smbclient //server/share

List shares anonymously:

smbclient -L [ip] -N

NOTE: -N flag indicates that no password is supplied. It suppresses the password prompt and specifies anonymous authentication.

Connect with a username:

smbclient //server/share -U [username]

Enum4linux

Enum4linux is a tool used to enumerate SMB shares on Windows and Linux systems during penetration testing. This tool gathers information about the target system, such as users and groups, shares and password policies.

To get the userlist from the target system:

enum4linux -U [ip]

To enumerate SMB shares on a target system:

enum4linux -S [ip]

To view the password policy on the target:

enum4linux -P [ip]

Security Measures to secure SMB:

Security measures are a must for SMB implementations. To mitigate the risks associated with insecure SMB, it is crucial to ensure the use of the latest SMB protocol version and do not use SMBv1 since it lacks encryption. In addition, enable SMB signing which adds an extra layer of security which prevents unauthorized access.

*There are more recommendations from Microsoft to secure SMB traffic *https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-secure-traffic

Disclaimer: The tools discussed in this article are intended for educational and informational purposes only. The author does not condone the use of these tools for any illegal or unethical purposes.