exploiting-smb-vulnerabilities-with-metasploit

What problem does it solve? Windows environments frequently contain unpatched SMB services, disabled SMB signing, and reused local administrator credentials that enable remote code execution and lateral movement. This Skill provides a structured workflow to enumerate, exploit, and document these weaknesses during authorized penetration tests so organizations can validate patch management and segmentation controls. ## Core Features & Use Cases - SMB Enumeration and Vulnerability Scanning: Discovers SMB hosts with Nmap and CrackMapExec, then checks for MS17-010 (EternalBlue), MS08-067, SMBGhost, and PrintNightmare using Metasploit auxiliary modules. - Exploitation and Lateral Movement: Executes EternalBlue for SYSTEM-level access, performs NTLM relay attacks against hosts without SMB signing, and uses pass-the-hash with CrackMapExec, Impacket psexec, or Metasploit psexec to move laterally. - Use Case: During an internal penetration test of a 200-host Active Directory domain, a tester identifies 12 unpatched servers, exploits EternalBlue on a file server, reuses the extracted local admin hash across 47 hosts, and documents a full attack chain leading to domain compromise. ## Quick Start Use this skill to scan the authorized target range 10.10.0.0/24 for SMB vulnerabilities with Metasploit and CrackMapExec, then exploit any hosts vulnerable to MS17-010 and document the findings.