SMB

SMB mixins are spread across lib/msf/core/exploit/remote/smb/. The main one is Msf::Exploit::Remote::SMB::Client, which includes Tcp, NTLM, and Report.

Main mixins

Mixin	Purpose
Msf::Exploit::Remote::SMB::Client	Basic connection
...::Client::Authenticated	Authenticated operations
...::Client::Psexec	PsExec-style operations
...::Client::PipeAuditor and others	Pipe enumeration
...::Server / Share	Attacker-side SMB server

Include example

include Msf::Exploit::Remote::SMB::Client
include Msf::Exploit::Remote::SMB::Client::Authenticated
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report

Common options

Option	Meaning
SMBUser / SMBPass / SMBDomain	Authentication (some fall back to USERNAME/PASSWORD/DOMAIN)
SMBDirect	Whether to use raw SMB on port 445
SMBName	NetBIOS name (for port 139)
SMB::ProtocolVersion	SMB dialect

Patterns

Version and share enumeration

def run_host(ip)
  connect
  smb_login
  # Shares, tree connections, etc.
  report_service(host: ip, port: rport, name: 'smb', info: ...)
rescue Rex::Proto::SMB::Exceptions::Error, Rex::ConnectionError => e
  vprint_error("#{ip}: #{e.message}")
ensure
  disconnect
end

Existing examples: modules/auxiliary/scanner/smb/smb_version.rb, smb_enumshares.rb, smb_login.rb

Authenticated file and pipe operations

Add the Authenticated mixin to work with files on shares and named pipes. AD CS and DCERPC modules may also use MsIcpr or a DCERPC mixin.

Attacker-side SMB server

Use SMB::Server when clients are made to connect so the module can receive hashes or serve files.

Cautions

• Enforced signing or disabled SMBv1 can cause failures. Check advanced options with show advanced.
• Do not put credentials in Git-tracked .rc files (the same rule as in the operations notes).