skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-smb-vulnerabilities-with-metasploit

Identifies and exploits SMB vulnerabilities using Metasploit during authorized penetration tests.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#lateral movement#pass-the-hash#metasploit#SMB#eternalblue#NTLM relay
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-smb-vulnerabilities-with-metasploit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-smb-vulnerabilities-with-metasploit
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/exploiting-smb-vulnerabilities-with-metasploit
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-smb-vulnerabilities-with-metasploit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Windows networks frequently expose SMB services with unpatched vulnerabilities, disabled signing, and reused credentials, but scanners alone cannot prove exploitability. This Skill provides a structured workflow to enumerate, exploit, and document SMB weaknesses so testers can demonstrate real risk instead of reporting unverified findings.

Core Features & Use Cases

  • SMB Enumeration and Scanning: Discover hosts, fingerprint SMB versions, check signing status, and scan for MS17-010, MS08-067, SMBGhost, and PrintNightmare using Nmap, CrackMapExec, and Metasploit auxiliary modules.
  • Exploitation and Lateral Movement: Exploit EternalBlue for SYSTEM access, perform NTLM relay attacks against signing-disabled hosts, and use pass-the-hash with psexec for lateral movement across the domain.
  • Use Case: During an internal penetration test of a 200-host Active Directory environment, use this Skill to find unpatched SMBv1 hosts, exploit one file server, reuse a dumped local admin hash across 47 machines, and document a full attack chain leading to domain compromise.

Quick Start

Ask the AI to enumerate SMB services on the authorized target range 10.10.0.0/24 and check for EternalBlue and SMB signing weaknesses using Metasploit and CrackMapExec.

Frequently Asked Questions about exploiting-smb-vulnerabilities-with-metasploit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit EternalBlue with Metasploit?▼

Use the exploit/windows/smb/ms17_010_eternalblue module, set RHOSTS, LHOST, and a windows/x64/meterpreter/reverse_tcp payload, then run exploit. Confirm success with getuid returning NT AUTHORITY\SYSTEM rather than relying on the auxiliary scanner alone.

How to find SMB hosts vulnerable to NTLM relay attacks?▼

Run crackmapexec smb <range> --gen-relay-list targets.txt to list hosts with SMB signing disabled. These hosts accept relayed NTLM authentication via impacket-ntlmrelayx even when fully patched against known CVEs.

Why does the MS17-010 scanner say vulnerable but exploitation fails?▼

The smb_ms17_010 auxiliary check can report likely vulnerable where the actual exploit fails due to x86 versus x64 grooming differences or non-English targets. Always confirm with the exploit module and an established session before marking a host exploitable.

Can pass-the-hash work without cracking NTLM hashes?▼

Yes, pass-the-hash authenticates using the captured NTLM hash directly via CrackMapExec, impacket-psexec, or Metasploit's psexec module. Set SMBPass to the full LM:NT hash string to execute commands as that user without knowing the plaintext password.

When should I not run EternalBlue during a penetration test?▼

Avoid EternalBlue against production domain controllers without a maintenance window, unstable legacy systems, or any host outside written authorization scope. The exploit can trigger a blue screen of death, especially on older or heavily loaded targets.

Related Skills

Explore More Software Engineering Skills→
crazyMarkycrazyMarky
277

recon-port-scan

Scan TCP and UDP ports and identify services with nmap, masscan, or rustscan.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
AeonDaveAeonDave
15

responder

Poison LLMNR, NBT-NS, and mDNS to capture Net-NTLMv2 hashes from Windows hosts.

Community
Advanced
ArianHobson333ArianHobson333
7

lateral-movement

Perform network lateral movement using Pass-the-Hash, WMI, WinRM, and SMB techniques.

Community
Advanced