> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-smb-139-445.md).

# TCP: SMB - 139 / 445

## Connection

```bash
impacket-smbexec [<Domain Name>/]<Username>[:<Password>]@<Target IP Address>
```

{% code overflow="wrap" %}

```bash
impacket-smbexec [<Domain Name>/]<Username>@<Target IP Address> -hashes :<NTLM Hash>
```

{% endcode %}

```bash
impacket-psexec [<Domain Name>/]<Username>[:<Password>]@<Target IP Address>
```

```bash
impacket-psexec [<Domain Name>/]<Username>@<Target IP Address> -hashes :<NTLM Hash>
```

```bash
impacket-wmiexec [<Domain Name>/]<Username>[:<Password>]@<Target IP Address>
```

```bash
impacket-wmiexec [<Domain Name>/]<Username>@<Target IP Address> -hashes :<NTLM Hash>
```

## Enumeration

### Identify Version

```bash
sudo nmap -p 139,445 -sV -Pn <Target IP Address>
```

{% code overflow="wrap" %}

```bash
tcpdump -i tun0 port <Port> and src <Target IP Address> -s0 -A -n 2>/dev/null & crackmapexec smb <Target IP Address> --shares --port <Port> 1>/dev/null 2>/dev/null
```

{% endcode %}

### Nmap

```bash
nmap --script "safe or smb-enum-*" -p 445 <Target IP Address>
```

```bash
nmap --script "smb-vuln*" -p 139,445 <Target IP Address>
```

### enum4linux

```bash
enum4linux -a <Target IP Address>
```

```bash
enum4linux -a <Target IP Address> -u <Username> -p <Password>
```

### smbclient

Null Session

```bash
smbclient -N -L //<Target IP Address>
```

List all shares

```bash
smbclient -L //<Target IP Address>/
```

Connecting to the particular share

```bash
smbclient //<Target IP Address>/<Share Name>/ -U [<Domain Name>\]<Username>
```

{% code overflow="wrap" %}

```bash
smbclient //<Target IP Address>/<Share Name>/ -U [<Domain Name>\]<Username> --pw-nt-hash <NTLM Hash>
```

{% endcode %}

List shares permission

```bash
smbmap -H <Target IP Address>
```

### smbget

Download target file

{% code overflow="wrap" %}

```bash
smbget smb://<Target IP Address>/<Share Name>/<File Name> [--user <Username>%<Password>]
```

{% endcode %}

Download target share

```bash
smbget -R smb://<Target IP Address>//<Share Name>
```

### crackmapexec

Enumerate SMB shares

```bash
crackmapexec smb <Target IP Address> [--users | --shares]
```

Null Authentication

```bash
crackmapexec smb <Target IP Address> --shares -u ' ' -p ''
```

```bash
crackmapexec smb <Target IP Address> --shares -u '' -p ''
```

To test if can authenticate

```bash
crackmapexec smb <Target IP Address> -u ' ' -p ''
```

Guest authentication

```bash
crackmapexec smb <Target IP Address> -u 'guest' -p ''
```

Checking authentication

Local User Authentication

```bash
crackmapexec smb <Target IP Address> -u <Username> -p <Password> --local-auth
```

Domain User Authentication

```bash
crackmapexec smb <Target IP Address> -u <Domain Name>\\<Username> -p <Password>
```

## Bruteforce

### nxc

{% code overflow="wrap" %}

```bash
nxc smb <Target IP Address> -d <Domain Name> -u <Username List> -p <Password List> --continue-on-success
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nxc smb <Target IP Address> -d <Domain Name> -u <Username List> -H <Hashes List> --continue-on-success
```

{% endcode %}

### hydra

```bash
hydra -L <Username List> -P <Password List> -f smb://<Target IP Address> [-p <Port>]
```

```bash
hydra -l <Username> -p <Password> -f smb://<Target IP Address> [-p <Port>]
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-smb-139-445.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.