🗂️ SMB — Port 139 / 445

Windows file/printer sharing. Deeper AD enum (enum4linux) is in methodology. Pass-the-Hash / lateral movement over SMB is in tools.

smbclient

smbclient -L //IP                       # list shares
smbclient //IP/DIR -U 'USERNAME'
smbclient //192.168.219.122/SYSVOL -U "hutch.offsec\fmcsorley"

Options: -N (no password) · -L (list) · -U (username).
Download recursively: recurse on → prompt off → mget *.

Enumerate with Nmap

nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.134.88

Impacket

psexec.py 'username:password'@IP_ADDRESS
impacket-smbserver -smb2support share $(pwd)      # serve files → see file-transfer

Reference: A little guide to SMB enumeration. Also serve/transfer files over SMB in file-transfer.