📭Exploiting SAMBA - Linux

Exploiting SAMBA

• SMB (Server Message Block) is a network file sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network (LAN).

• SMB uses port 445 (TCP). However, originally, SMB ran on top of NetBIOS using port 139.

• Samba is the Linux implementation of SMB, and allows Windows systems to access Linux shares and devices.

• SAMBA utilizes username and password authentication in order to obtain access to the server or a network share.

• We can perform a brute-force attack on the SAMBA server in order to obtain legitimate credentials.

• After obtaining legitimate credentials, we can use a utility called SMBMap in order to enumerate SAMBA share drives, list the contents of the shares as well as download files and execute remote commands on the target.

• We can also utilize a tool called smbclient. smbclient is a client that is part of the SAMBA software suite. It communicates with a LAN Manager server, offering an interface similar to that of the ftp program. It can be used to download files from the server to the local machine, upload files from the local machine to the server as well as retrieve directory information from the server.

Attack Flow for Exploiting SAMBA

1. Using Metasploit for Brute-Force SMB Login

• Objective: To brute-force SMB credentials to gain unauthorized access to SAMBA shares.

• Tool: Metasploit

• Command:

  use auxiliary/scanner/smb/smb_login

  Followed by setting necessary options:

  set RHOSTS <target>
  set USERNAME <user>
  set PASS_FILE /usr/share/wordlists/rockyou.txt
  run

• Description: Metasploit is a powerful penetration testing framework. The auxiliary/scanner/smb/smb_login module performs a brute-force attack on SMB credentials. You specify the target IP address (RHOSTS), the username (USERNAME), and the path to the password list (PASS_FILE). The module attempts to log in using combinations of the provided username and passwords from the wordlist.

2. Using Hydra for Brute-Force SMB Authentication

• Objective: To perform a brute-force attack against the SMB service to guess the password for a given username.

• Tool: Hydra

• Command:

  hydra -l admin -P /usr/share/wordlists/rockyou.txt <target> smb

• Description: Hydra is a popular tool for brute-forcing various protocols. In this command, -l admin specifies the username "admin", -P indicates the path to the password list, and <target> is the IP address or hostname of the target machine. Hydra uses the "rockyou.txt" wordlist to try different passwords for the "admin" user on the SMB service.

3. Using Metasploit for SMB Named Pipe Security Assessment

• Objective: To assess the security of SMB named pipes on the target network.

• Tool: Metasploit

• Command:

  use auxiliary/scanner/smb/pipe_auditor

  Followed by setting necessary options:

  set RHOSTS <target>
  set SMBPIPE <pipe_name>
  run

• Description: The auxiliary/scanner/smb/pipe_auditor module in Metasploit is used to audit SMB named pipes for potential security issues. You set the target host (RHOSTS) and specify the named pipe to audit (SMBPIPE). This module checks for vulnerabilities or misconfigurations in SMB named pipes, which could be exploited for further access.

For more detailed techniques on gaining access to the server using SAMBA, you can refer to the provided resource.

📜SMB Enumeration

---

---

---

Hacker's Mantra:Human Stupidity, that’s why Hackers always win. - Med Amine Khelifi