SMB / MSRPC / NTLM

Back to the Command Index

This category covers SMB sessions, NTLM tokens, the Endpoint Mapper, and relay. The CLI normally sees only SMBConnection, while the underlying smb.SMB / smb3.SMB3 hold the dialect and signing key.

Related Technologies

• SMB / NetBIOS — 139/445, signing, SMB3 ApplicationKey
• NTLM / SPNEGO / NEGOEX — Type1/2/3, MIC, CBT
• DCE/RPC and NDR — EPM, string binding
• Kerberos — AP-REQ for cifs/<host>

SimpleSMBServer supports SMB 2.0.2, 2.1, and 3.1.1. When adding relay support, keep the four boundaries of inbound server, outbound client, attack module, and target state distinct.

Command Index

Command	Summary
DumpNTLMInfo.py	Negotiates NTLM through SMB or RPC and displays challenge information, SMB settings, time, and related details.
Get-GPPPassword.py	Finds Group Policy Preferences XML locally or on SMB shares, then extracts and decrypts cpassword.
attrib.py	Queries or changes DOS/NTFS attributes of files and directories over SMB.
filetime.py	Queries or changes creation, access, write, and change times for files and directories over SMB.
getArch.py	Infers whether a target host is 32-bit or 64-bit from a connection to its RPC Endpoint Mapper.
karmaSMB.py	Starts a test SMB server that returns a payload based on the share or file name requested by a client.
ntlmrelayx.py	Relays received NTLM authentication to selected targets and runs the corresponding attack module. Supports multiple inbound and outbound protocols.
rpcdump.py	Queries the Endpoint Mapper and lists the RPC interfaces and binding information exposed by a target host.
rpcmap.py	Probes a specified DCE/RPC endpoint for available UUIDs, versions, and opnums through management interfaces or discovery.
sambaPipe.py	Places a .so on a share and opens a named pipe to test Samba’s external pipe module loading.
smbclient.py	Provides an interactive shell for SMB shares, directories, files, and ACLs. Also supports batch execution from an input file.
smbserver.py	Shares a local directory over SMB. Supports SMB1 and SMB 2.0.2/2.1/3.1.1, NTLM/Kerberos authentication, and read-only settings.
rdp_check.py	Checks whether a specified account can authenticate through RDP/CredSSP.