> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/smb-discovery/nmap-smb-nse-scripts.md). # Nmap SMB NSE Scripts The NSE scripts are located in the /usr/share/nmap/scripts directory. ## Discovery scripts To run all discovery scripts on the SMB ports ```bash nmap -v -p 139,445 --script "discovery and smb*" $TARGET_IP ``` ## Full Enumeration To run all SMB-related enumeration scripts in `nmap` ```bash nmap -v -p 139,445 --script smb-*enum* $TARGET_IP ``` Available scripts are: * [smb-enum-domains](https://nmap.org/nsedoc/scripts/smb-enum-domains.html) * [smb-enum-groups](https://nmap.org/nsedoc/scripts/smb-enum-groups.html) * [smb-enum-processes](https://nmap.org/nsedoc/scripts/smb-enum-processes.html) * [smb-enum-services](https://nmap.org/nsedoc/scripts/smb-enum-services.html) * [smb-enum-sessions](https://nmap.org/nsedoc/scripts/smb-enum-sessions.html) * [smb-enum-shares](https://nmap.org/nsedoc/scripts/smb-enum-shares.html) * [smb-enum-users](https://nmap.org/nsedoc/scripts/smb-enum-users.html) * [smb-mbenum](https://nmap.org/nsedoc/scripts/smb-mbenum.html) ## List Shares Attempts to list shares using the `srvsvc.NetShareEnumAll` MSRPC function, with the script [smb-enum-shares](https://nmap.org/nsedoc/scripts/smb-enum-shares.html) ```bash nmap -v -p 139,445 --script smb-enum-shares $TARGET_IP ``` ## OS Discovery Run OS discovery, i.e. the script [smb-os-discovery](https://nmap.org/nsedoc/scripts/smb-os-discovery.html) ```bash nmap -v -p 139,445 --script smb-os-discovery $TARGET_IP ``` ## List of SMB scripts ### Information Gathering
ScriptDescription
smb-enum-domainsAttempts to enumerate domains on a system, along with their policies. This generally requires credentials, except against Windows 2000. In addition to the actual domain, the "Builtin" domain is generally displayed. Windows returns this in the list of domains, but its policies don't appear to be used anywhere.
smb-enum-groupsObtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to enum.exe with the /G switch.
smb-enum-processesPulls a list of processes from the remote server over SMB. This will determine all running processes, their process IDs, and their parent processes. It is done by querying the remote registry service, which is disabled by default on Vista; on all other Windows versions, it requires Administrator privileges.
smb-enum-servicesRetrieves the list of services running on a remote Windows system. Each service attribute contains service name, display name and service status of each service.
smb-enum-sessionsEnumerates the users logged into a system either locally or through an SMB share. The local users can be logged on either physically on the machine, or through a terminal services session. Connections to a SMB share are, for example, people connected to fileshares or making RPC calls. Nmap's connection will also show up, and is generally identified by the one that connected "0 seconds ago".
smb-enum-sharesAttempts to list shares using the srvsvc.NetShareEnumAll MSRPC function and retrieve more information about them using srvsvc.NetShareGetInfo. If access to those functions is denied, a list of common share names are checked.
smb-enum-usersAttempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques (both over MSRPC, which uses port 445 or 139; see smb.lua). The goal of this script is to discover all user accounts that exist on a remote system. This can be helpful for administration, by seeing who has an account on a server, or for penetration testing or network footprinting, by determining which accounts exist on a system.
smb-lsAttempts to retrieve useful information about files shared on SMB volumes. The output is intended to resemble the output of the UNIX ls command.
smb-mbenumQueries information managed by the Windows Master Browser.
smb-os-discoveryAttempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol (ports 445 or 139). This is done by starting a session with the anonymous account (or with a proper user account, if one is given; it likely doesn't make a difference); in response to a session starting, the server will send back all this information.
smb-protocolsAttempts to list the supported protocols and dialects of a SMB server.
smb-security-modeReturns information about the SMB security level determined by SMB.
smb-server-statsAttempts to grab the server's statistics over SMB and MSRPC, which uses TCP ports 445 or 139.
smb-system-infoPulls back information about the remote system from the registry. Getting all of the information requires an administrative account, although a user account will still get a lot of it. Guest probably won't get any, nor will anonymous. This goes for all operating systems, including Windows 2000.
smb2-capabilitiesAttempts to list the supported capabilities in a SMBv2 server for each enabled dialect.
smb2-security-modeDetermines the message signing configuration in SMBv2 servers for all supported dialects.
smb2-timeAttempts to obtain the current system date and the start date of a SMB2 server.
### Vulnerability scanning
ScriptDescription
smb-vuln-cve-2017-7494Checks if target machines are vulnerable to the arbitrary shared library load vulnerability CVE-2017-7494.
smb-vuln-cve2009-3103Detects Microsoft Windows systems vulnerable to denial of service (CVE-2009-3103). This script will crash the service if it is vulnerable.
smb-vuln-ms06-025Detects Microsoft Windows systems with Ras RPC service vulnerable to MS06-025.
smb-vuln-ms07-029Detects Microsoft Windows systems with Dns Server RPC vulnerable to MS07-029.
smb-vuln-ms08-067Detects Microsoft Windows systems vulnerable to the remote code execution vulnerability known as MS08-067. This check is dangerous and it may crash systems.
smb-vuln-ms10-054Tests whether target machines are vulnerable to the ms10-054 SMB remote memory corruption vulnerability.
smb-vuln-ms10-061Tests whether target machines are vulnerable to ms10-061 Printer Spooler impersonation vulnerability.
smb-vuln-ms17-010Attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code execution vulnerability (ms17-010, a.k.a. EternalBlue). The vulnerability is actively exploited by WannaCry and Petya ransomware and other malware.
smb-vuln-regsvc-dosChecks if a Microsoft Windows 2000 system is vulnerable to a crash in regsvc caused by a null pointer dereference. This check will crash the service if it is vulnerable and requires a guest account or higher to work.
smb-vuln-webexecA critical remote code execution vulnerability exists in WebExService (WebExec).
smb2-vuln-uptimeAttempts to detect missing patches in Windows systems by checking the uptime returned during the SMB2 protocol negotiation.
## Script Help You can get help about a specific NSE script with ```bash nmap --script-help smb-enum-users ``` To get help about several scripts you can use wildcards such as ```bash nmap --script-help smb-enum-* ``` Or you can get help about all scripts in a specific category ```bash nmap --script-help discovery ``` ## Usage information
nmap --help ```bash ┌──(kali㉿kali)-[~/OffSec_Cources] └─$ nmap --help Nmap 7.94SVN ( https://nmap.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 -iL : Input from list of hosts/networks -iR : Choose random targets --exclude : Exclude hosts/networks --excludefile : Exclude list from file HOST DISCOVERY: -sL: List Scan - simply list targets to scan -sn: Ping Scan - disable port scan -Pn: Treat all hosts as online -- skip host discovery -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes -PO[protocol list]: IP Protocol Ping -n/-R: Never do DNS resolution/Always resolve [default: sometimes] --dns-servers : Specify custom DNS servers --system-dns: Use OS's DNS resolver --traceroute: Trace hop path to each host SCAN TECHNIQUES: -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans -sU: UDP Scan -sN/sF/sX: TCP Null, FIN, and Xmas scans --scanflags : Customize TCP scan flags -sI : Idle scan -sY/sZ: SCTP INIT/COOKIE-ECHO scans -sO: IP protocol scan -b : FTP bounce scan PORT SPECIFICATION AND SCAN ORDER: -p : Only scan specified ports Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9 --exclude-ports : Exclude the specified ports from scanning -F: Fast mode - Scan fewer ports than the default scan -r: Scan ports sequentially - don't randomize --top-ports : Scan most common ports --port-ratio : Scan ports more common than SERVICE/VERSION DETECTION: -sV: Probe open ports to determine service/version info --version-intensity : Set from 0 (light) to 9 (try all probes) --version-light: Limit to most likely probes (intensity 2) --version-all: Try every single probe (intensity 9) --version-trace: Show detailed version scan activity (for debugging) SCRIPT SCAN: -sC: equivalent to --script=default --script=: is a comma separated list of directories, script-files or script-categories --script-args=: provide arguments to scripts --script-args-file=filename: provide NSE script args in a file --script-trace: Show all data sent and received --script-updatedb: Update the script database. --script-help=: Show help about scripts. is a comma-separated list of script-files or script-categories. OS DETECTION: -O: Enable OS detection --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively TIMING AND PERFORMANCE: Options which take
## Resources NSEDoc Reference Portal: NSE Categories: NSE Scripts: