> For the complete documentation index, see [llms.txt](https://leecybersec.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://leecybersec.gitbook.io/oscp/scanning/common-services/smb-139-445.md).

# SMB - 139, 445

## Server Connection

### smbmap

```
$ smbmap -H $ip

$ smbmap -u <user> -H $ip
```

### smbclient

```
$ smbclient -L $ip

$ smbclient -N -L //10.10.10.4
```

## Scanning Vul

```
$ ls -l /usr/share/nmap/scripts/smb*

$ nmap -p 139,445 --script smb-vul* $ip
```

## SMB Enum

### Guess Server's Version

```
$ nmap -A 10.10.10.4

$ nmap -p 139,445 $ip --script-args=unsafe=1 --script /usr/share/nmap/scripts/smb-os-discovery
```

### Mount Access

```
$ mount -t cifs -o user=USERNAME,sec=ntlm,dir_mode=0077 "//ip/My Share" /mnt/cifs

$ mount -o nolock $ip:/home ~/home/
```

```
-rwx------ 1 1014  1014   48 Jun 10 09:16 creds.txt

$ sudo adduser pwn
$ sudo sed -i -e 's/1001/1014/g' /etc/passwd
$ su pwn
$ cat creds.txt
```

### smbclient

```
$ smbclient //ip/tmp

$ smbclient \\\\ip\\ipc$ -U john 

$ smbclient //ip/ipc$ -U john
```

### nbtscan

```
$ nbtscan -r $ip
```

### Enum4linux

```
$ enum4linux -a $ip
```

### rpcclient

```
$ rpcclient -U "" $ip
```

## SMB Common Commands

```
$ srvinfo
$ enumdomusers
$ getdompwinfo
$ querydominfo
$ netshareenum
$ netshareenumall
```