hackingyseguridad/smbSMBv1: CVE-2017-0143, gravedad 8.8, de ejecucion remota de codigo (RCE), en Windows con SMBv1 (ms17-010)
███████╗███╗ ███╗██████╗ ███║
██╔════╝████╗ ████║██╔══██╗ ║██║
███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║
╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║
███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║
╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝
SMB is a network protocol that allows sharing files, printers and other resources between machines. SMB v1 (Server Message Block version 1), insecure and obsolete for sharing files on the network.
SMB v1 - Insecure !!!
No encryption: Transmits data in plain text, including usernames and passwords.
Serious vulnerabilities: Exploited by malware
WannaCry: Ransomware that affected millions in 2017. EternalBlue: Exploit developed by the NSA, used in WannaCry.
NotPetya: Malware that caused billions in losses.
Multiple documented vulnerabilities (CVE-2017-0143, etc.).
Detect version:
other quick commands
sudo mount -t cifs //10.0.0.1/Public /mnt -o guest
Search for specific files in shares
for share in $(smbclient -L //192.168.1.100 -N 2>/dev/null | awk '/Disk/ {print $1}'); do echo "Searching in $share:" smbclient -N //192.168.1.100/$share -c "ls pass; ls backup" 2>/dev/null done
for user in admin administrator guest test; do echo -n "Testing $user:password123... " smbclient -L //192.168.1.100 -U "$user%password123" 2>&1 | grep -q "session setup failed" && echo "FAIL" || echo "OK" done
smbclient -U "user%pass" //192.168.1.100/ShareName -c "prompt OFF; recurse ON; mget *"
SMBv1: vulnerability CVE-2017-0143, severity 8.8, remote code execution (RCE), on Windows with SMBv1 (ms17-010)
EternalBlue is an exploit created by the NSA as a cybersecurity tool. The official exploit name, provided by Microsoft, is MS17-010. This exploit is not specific to Windows devices, but affects any device compatible with Microsoft's SMBv1 server protocol.
SMBv1 on: Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1 and Windows 10 Gold, 1511 and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary code through crafted packets, a vulnerability also known as "Windows SMB Remote Code Execution Vulnerability". This vulnerability is distinct from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146 and CVE-2017-0148.
https://www.exploit-db.com/exploits/41891
Scripts at : https://github.com/hackingyseguridad/smb/
| scansmbnull.sh | Detects and enumerates null sessions (Null Sessions). |
| ms08-068_tester.sh | Test for vulnerability MS08-068 (CVE-2008-4036). |
| scansmbghost.sh | Detects systems potentially vulnerable to SMBGhost (CVE-2020-0796). |
| smbuserenum.sh | Enumerates users via SMB. |
| bruteinvsmb.sh | Performs reverse brute force of credentials. |
SMB without authentication (Null Session): Allows enumerating users, shares and other system information without credentials. Scripts: scansmbnull.sh, smbuserenum.sh, scansmb.sh.
Default, weak or guessable passwords via direct and reverse brute force. Scripts: bruteinvsmb.sh (probably for reverse brute force), other commands in the README test simple credentials.
CVE-2008-4036 (MS08-068): A local privilege escalation vulnerability in SMB. Script: ms08-068_tester.sh. CVE-2020-0796 (SMBGhost): A buffer overflow bug in SMBv3. Script: scansmbghost.sh.
Shares configured with excessive permissions (such as read-only or write access for "guest").Scripts: automontar.sh, smbauto.sh, smbescribefichero.sh (to write a file), scansmbfile.sh (to search for files).