skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-smb

Tests SMB/CIFS services on ports 445 and 139 for enumeration, credential attacks, and lateral movement.

954|172|Updated Mar 13, 2026
Search Tags:#enumeration#pass-the-hash#penetration-testing#Active-Directory#lateral-movement#SMB#eternalblue
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-smb
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-smb
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-smb
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-smb

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Penetration testers assessing Windows and Samba hosts need a structured methodology for attacking SMB/CIFS services, from anonymous enumeration through credentialed access and lateral movement, without missing critical checks like null sessions, SMB signing, or EternalBlue.

Core Features & Use Cases

  • Share and User Enumeration: Enumerate shares, users, groups, and password policies via null sessions, guest access, RID cycling, and tools like enum4linux-ng, rpcclient, and netexec.
  • Credential Attacks and Secrets Dumping: Perform password spraying, Pass-the-Hash, SAM/LSA dumping with secretsdump.py, and hunt for GPP passwords in SYSVOL.
  • Lateral Movement and Command Execution: Execute commands via psexec, wmiexec, smbexec, and atexec, and relay NTLM authentication when SMB signing is not required.
  • Use Case: During an authorized internal Active Directory assessment, a tester finds TCP 445 open, confirms a null session with crackmapexec, extracts a domain user list, sprays a common password, and uses the resulting admin hash to move laterally with wmiexec.

Quick Start

Ask the AI to enumerate SMB shares and users on the authorized target host at the given IP address and check for null sessions and MS17-010.

Frequently Asked Questions about pentesting-smb

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate SMB shares and users on a target host?▼

Enumerate SMB shares with smbclient --no-pass -L, smbmap -H, or crackmapexec smb with empty credentials. For users and groups, use enum4linux-ng -A, rpcclient enumdomusers, or crackmapexec --users and --rid-brute over a null or guest session.

How to check for EternalBlue MS17-010 vulnerability?▼

Check for MS17-010 with nmap --script smb-vuln-ms17-010 -p 445 or crackmapexec smb <IP> -M ms17-010. Only run the actual exploit with explicit written authorization, since the kernel pool overflow can crash the target host.

What is the difference between psexec, wmiexec, and smbexec?▼

psexec creates a new service via the svcctl named pipe, wmiexec runs fileless commands through DCOM on port 135, and smbexec executes commands via a service without uploading a binary. All are impacket tools supporting Pass-the-Hash and Kerberos.

Does Pass-the-Hash work against SMB with netexec or crackmapexec?▼

Yes, Pass-the-Hash works by supplying the NT hash with crackmapexec smb <IP> -u Administrator -H <NTHASH> or impacket tools using -hashes <LM:NT>. A Pwn3d! result indicates local admin access on the target.

Why does SMB null session enumeration return access denied?▼

Access denied means the share exists but anonymous access is blocked, while NT_STATUS_BAD_NETWORK_NAME means the share does not exist. Try the guest account with a blank password, which often lists shares even when null sessions fail.

When should SMB relay attacks be used during a pentest?▼

SMB relay with ntlmrelayx.py applies when netexec reports signing:False, meaning SMB signing is not required and NTLM authentication can be relayed to other hosts. It only works in authorized engagements where captured credentials can be forwarded to targets without signing.

Related Skills

Explore More Software Engineering Skills→
duriandurinoduriandurino

enum

Discover live hosts and enumerate open ports and services with nmap, gobuster, feroxbuster, and ffuf.

Community
Intermediate
rahmatullahbossrahmatullahboss

Windows Privilege Escalation

Detect and exploit privilege escalation paths in Windows environments.

Community
Advanced
OpenTideHQOpenTideHQ
4

network-protocols

Explain network protocol internals for detection engineering across DNS, TLS, SMB, and more.

Official
Advanced
AeonDaveAeonDave
15

crackmapexec

Automate Active Directory credential spraying, enumeration, and remote command execution over SMB and WinRM.

Community
Advanced