SMB and RPC

RPCCLIENT

rpcclient -U "" -N [IP]

rpcclient -U "Username" -N 10.10.11.42 

• when connecting via rpcclient

  • enumdomusers give the list of users

  • enumdomgroups give groups

  • lookupnames <name> give SID

  • srvinfo to give server info

  • querydispinfo

SMBMAP

smbmap -H [IP] -u [Username] -p 'password'

• To recursively enum directories

smbmap -H [IP] -u [Username] -p 'password' -r 'DIRECTORY NAME' --dir-only

• To upload files

smbmap -u <user> -p "<password>" -d . -H [IP] --upload '/path/to/file' '/path/to/upload

SMBCLIENT

smbclient -L [IP] -N

smbclient //IP/SHARE NAME

for downloading whole directory (smbmap or smbclient)

mask ""

recurse ON

prompt OFF

mget *

Netexec/ crackmapexec

netexec smb 172.16.1.0/24 -u anonymous -p ''  --shares

netexec smb 192.168.110.52-56 -u James -H :8af1903d3c80d3552a84b6ba296db2ea -d .