Skip to content

Commit c953842

Browse files
committed
Added docs and additional dialects
1 parent 7d07f70 commit c953842

File tree

2 files changed

+61
-1
lines changed
  • documentation/modules/auxiliary/scanner/smb
  • modules/auxiliary/scanner/smb

2 files changed

+61
-1
lines changed
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Description
2+
This module scans for hosts that support the SMBv1 protocol. It works by sending an SMB_COM_NEGOTATE request to each host specified in RHOSTS and claims that it only supports the following SMB dialects:
3+
```PC NETWORK PROGRAM 1.0
4+
LANMAN1.0
5+
Windows for Workgroups 3.1a
6+
LM1.2X002
7+
LANMAN2.1
8+
NT LM 0.12
9+
```
10+
If the SMB server has SMBv1 enabled it will respond to the request with a dialect selected.
11+
If the SMB server does not support SMBv1 a RST will be sent.
12+
13+
___
14+
# Usage
15+
16+
The following is an example of its usage, where x.x.x.x allows SMBv1 and y.y.y.y does not.
17+
18+
#### A host that does support SMBv1.
19+
20+
```
21+
msf auxiliary(smb1) > use auxiliary/scanner/smb/smb1
22+
msf auxiliary(smb1) > set RHOSTS x.x.x.x
23+
RHOSTS => x.x.x.x
24+
msf auxiliary(smb1) > run
25+
26+
[+] x.x.x.x:445 - x.x.x.x supports SMBv1 dialect.
27+
[*] Scanned 1 of 1 hosts (100% complete)
28+
[*] Auxiliary module execution completed
29+
msf auxiliary(smb1) > services -S x.x.x.x
30+
31+
Services
32+
========
33+
34+
host port proto name state info
35+
---- ---- ----- ---- ----- ----
36+
10.10.2.99 445 tcp smb1 open
37+
```
38+
39+
#### A host that does not support SMBv1
40+
41+
```
42+
msf auxiliary(smb1) > use auxiliary/scanner/smb/smb1
43+
msf auxiliary(smb1) > set RHOSTS y.y.y.y
44+
RHOSTS => 10.10.48.14
45+
msf auxiliary(smb1) > run
46+
47+
[*] Scanned 1 of 1 hosts (100% complete)
48+
[*] Auxiliary module execution completed
49+
```
50+
___
51+
52+
53+
## Options
54+
55+
The only option is RHOSTS, which can be specified as a single IP, hostname, or an IP range in CIDR notation or range notation. It can also be set using hosts from the database using ```hosts -R```.

modules/auxiliary/scanner/smb/smb1.rb

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,12 @@ def run_host(ip)
3434
connect
3535

3636
# Only accept NT LM 0.12 dialect and WfW3.0
37-
dialects = ['NT LM 0.12']
37+
dialects = ['PC NETWORK PROGRAM 1.0',
38+
'LANMAN1.0',
39+
'Windows for Workgroups 3.1a',
40+
'LM1.2X002',
41+
'LANMAN2.1',
42+
'NT LM 0.12']
3843
data = dialects.collect { |dialect| "\x02" + dialect + "\x00" }.join('')
3944

4045
pkt = Rex::Proto::SMB::Constants::SMB_NEG_PKT.make_struct

0 commit comments

Comments
 (0)