SMB Enumeration

Nmap script

• /usr/share/nmap/scripts/smb*

SMB Version

• SMB1 – Windows 2000, XP and Windows 2003.
• SMB2 – Windows Vista SP1 and Windows 2008
• SMB2.1 – Windows 7 and Windows 2008 R2
• SMB3 – Windows 8 and Windows 2012.

Scanning for the NetBIOS

• nmap -v -p 139,445 -oG smb.txt x.x.x.1-254
• Show NETBIOS users: nbtscan -r x.x.x.0/24
• Scan for OS: nmap -v -p 139, 445 --script=smb-os-discovery x.x.x.x

Null Session Enumeration.

• in SMB1
• To allow unauthenticated hackers to obtain large amounts of information
• enum4linux -a victim-ip <========= USEFUL

Check for vulnerabilites

• unsafe=1 may harm the victim PC: nmap -v -p 139,445 --script=smb-vuln --script-args=unsafe=1 victim-ip