Original subtitles

The first service we want to introduce is SMB.

SMB is a window is a implementation of a file share.

And there's SIFS, which is the common unit file system, which is the generic term for

SMB's dancers serve a message block, but they basically work the same.

Let's take a look.

We have one-doers machine.

And we have RIP address as this 104056.

And we're on a sub-domask of 255255 240.

So that's a Cider20 notation.

And it ran NMAP scan with that Cider20 looking for open ports.

And we came across this 10407133.

This is us.

My IP can big.

So in both situations, we see that we've got 135139 and 445 open.

These are Windows machines.

These are fairly common ports to see open on a Windows machine.

3389 also gets a second.

This is a server over here.

So 445 is where SMB or SIFS hangs out.

Net BIOS used to be a bigger part of SMB in older version of Windows.

It still exists, still used.

And usually sets up the session for SMB.

We run this scan looking for our service numeration and our operating system.

Then we see for sure that this is Microsoft Windows Server.

2.0.2 or 2012 running that version of SMB.

The fingerprint operating system figure print didn't find anything.

But the service information tells us that it's a Windows Server 2008 to 2012.

That's good enough for what we want right now.

Because really what we're showing is what SMB does.

RANIS scan with tech S, lowercase S, uppercase C.

This does the default scripts.

And it gathered some information for us.

Since the new 3389 is open, it got the Net BIOS domain name, a computer name, which doesn't give us really anything for this machine.

But it could be helpful for other machines.

Again, not anything too terribly useful.

Some SMBOS discovery, security modes, and time.

This is helpful SMB enumeration right there.

And we'll break this out in the future looking at this NBS stat or NB stat.

And more of this SMB and map scans in the future.

But just want to show you what SMB is.

Best way to open up File Explorer.

We go to our network and we will map a network drive.

Take like a Z drive. You might see this very often in an enterprise system, an office setting.

Barely in a home network.

But if we put in our IP address, this 10...

4...

17133, and then go to browse.

We can see that on the network there's that machine.

And we'll go with the C drive.

Hit OK, and finish.

And now we've got this on our computer, the Z drive, which is map 2, the C drive on 133.

We can go in and look at users, Bob, and this is different than our own machine.

On our machine, C drive, users just looks like that.

Again, this is RZ drive, Z drive matches to the C drive on 133.

There's other different that is SMB and practice.

There are command line scripts for setting up and getting rid of SMB.

The best way to really show that is I will put this over here.

I don't do net use star dash to lead.

It's a flag, and they use star forward slash.

Dilly, back slash, it's looking for a network.

And it's going to say, we're going to remove these remote connections.

Do we want to do that?

Yes.

And force them closed.

Yes.

We see it is removed.

We do a head open to spirit as well.

We could reconnect it with the command.

It's net use.

We'll call this Z drive again.

We'll call this Z drive again.

We'll call this Z drive again.

We'll call this Z drive again.

These are as a bit straighter.

And we see it is back.

And that's the basics of how SMB works.

Now we get into some details about how we can take advantage of SMB, but that's the protocol

and are not shell.

I hope that was informative.

See how else we can play with it.