|
| 1 | +## Description |
| 2 | + |
| 3 | +The smb_enumshares module, as would be expected, enumerates any SMB shares that are available on a remote system. |
| 4 | + |
| 5 | +## Verification Steps |
| 6 | + |
| 7 | +1. Do: ```use auxiliary/scanner/smb/smb2``` |
| 8 | +2. Do: ```set RHOSTS [IP]``` |
| 9 | +3. Do: ```set THREADS [number of threads]``` |
| 10 | +4. Do: ```run``` |
| 11 | + |
| 12 | +## Scenarios |
| 13 | + |
| 14 | +**Running the scanner** |
| 15 | +``` |
| 16 | +msf > use auxiliary/scanner/smb/smb_enumshares |
| 17 | +msf auxiliary(smb_enumshares) > show options |
| 18 | +
|
| 19 | +Module options (auxiliary/scanner/smb/smb_enumshares): |
| 20 | +
|
| 21 | + Name Current Setting Required Description |
| 22 | + ---- --------------- -------- ----------- |
| 23 | + LogSpider 3 no 0 = disabled, 1 = CSV, 2 = table (txt), 3 = one liner (txt) (Accepted: 0, 1, 2, 3) |
| 24 | + MaxDepth 999 yes Max number of subdirectories to spider |
| 25 | + RHOSTS yes The target address range or CIDR identifier |
| 26 | + SMBDomain . no The Windows domain to use for authentication |
| 27 | + SMBPass no The password for the specified username |
| 28 | + SMBUser no The username to authenticate as |
| 29 | + ShowFiles false yes Show detailed information when spidering |
| 30 | + SpiderProfiles true no Spider only user profiles when share = C$ |
| 31 | + SpiderShares false no Spider shares recursively |
| 32 | + THREADS 1 yes The number of concurrent threads |
| 33 | + USE_SRVSVC_ONLY false yes List shares only with SRVSVC |
| 34 | +
|
| 35 | +msf auxiliary(smb_enumshares) > set RHOSTS 192.168.1.150-165 |
| 36 | +RHOSTS => 192.168.1.150-165 |
| 37 | +msf auxiliary(smb_enumshares) > set THREADS 16 |
| 38 | +THREADS => 16 |
| 39 | +msf auxiliary(smb_enumshares) > run |
| 40 | +
|
| 41 | +[*] 192.168.1.154:139 print$ - Printer Drivers (DISK), tmp - oh noes! (DISK), opt - (DISK), IPC$ - IPC Service (metasploitable server (Samba 3.0.20-Debian)) (IPC), ADMIN$ - IPC Service (metasploitable server (Samba 3.0.20-Debian)) (IPC) |
| 42 | +Error: 192.168.1.160 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) |
| 43 | +Error: 192.168.1.160 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) |
| 44 | +[*] 192.168.1.161:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) |
| 45 | +Error: 192.168.1.162 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) |
| 46 | +Error: 192.168.1.150 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) |
| 47 | +Error: 192.168.1.150 Rex::Proto::SMB::Exceptions::ErrorCode The server responded with error: STATUS_ACCESS_DENIED (Command=37 WordCount=0) |
| 48 | +[*] Scanned 06 of 16 hosts (037% complete) |
| 49 | +[*] Scanned 09 of 16 hosts (056% complete) |
| 50 | +[*] Scanned 10 of 16 hosts (062% complete) |
| 51 | +[*] Scanned 14 of 16 hosts (087% complete) |
| 52 | +[*] Scanned 15 of 16 hosts (093% complete) |
| 53 | +[*] Scanned 16 of 16 hosts (100% complete) |
| 54 | +[*] Auxiliary module execution completed |
| 55 | +msf auxiliary(smb_enumshares) > |
| 56 | +``` |
| 57 | + |
| 58 | +As you can see, since this is an un-credentialed scan, access is denied a most of the systems that are probed. Passing user credentials to the scanner will produce much different results. |
| 59 | + |
| 60 | +``` |
| 61 | +msf auxiliary(smb_enumshares) > set SMBPass s3cr3t |
| 62 | +SMBPass => s3cr3t |
| 63 | +msf auxiliary(smb_enumshares) > set SMBUser Administrator |
| 64 | +SMBUser => Administrator |
| 65 | +msf auxiliary(smb_enumshares) > run |
| 66 | +
|
| 67 | +[*] 192.168.1.161:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) |
| 68 | +[*] 192.168.1.160:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) |
| 69 | +[*] 192.168.1.150:139 IPC$ - Remote IPC (IPC), ADMIN$ - Remote Admin (DISK), C$ - Default share (DISK) |
| 70 | +[*] Scanned 06 of 16 hosts (037% complete) |
| 71 | +[*] Scanned 07 of 16 hosts (043% complete) |
| 72 | +[*] Scanned 12 of 16 hosts (075% complete) |
| 73 | +[*] Scanned 15 of 16 hosts (093% complete) |
| 74 | +[*] Scanned 16 of 16 hosts (100% complete) |
| 75 | +[*] Auxiliary module execution completed |
| 76 | +msf auxiliary(smb_enumshares) > |
| 77 | +``` |
0 commit comments