139_445_SMB

NOTE

List Shares net share

SMB Enumeration (445, 139)

  • Check Shares (Null Session)
    • smbclient -L //<IP> -N
  • User Enumeration
    • enum4linux-ng -A <IP>
    • crackmapexec smb <IP> --users
  • Detailed Share Access
    • smbmap -H <IP> (Check for READ/WRITE permissions)
  • Download Files
    • smbclient //<IP>/<SHARENAME> -> recurse ON, prompt OFF, mget *

Follow-up checks:

  • EternalBlue (MS17-010): Check with nmap --script smb-vuln-ms17-010 -p 445 <IP>
  • PrintNightmare: If you have low-priv credentials.
  • Sensitive Data: Look for web.config, settings.json, or .txt files containing passwords.

References