SMB:

Exploitation

SMB shells via relay, PtH, RCE exploits, and share abuse

5 guides • 3 steps • Created Dec 28, 2025 • Updated Mar 29, 2026

5 guides

SMB NTLM Relay – Hash Relay to Shell

Exploit SMB NTLM relay attacks to capture and relay authentication hashes, escalating from network access to remote code execution via compromised credentials.

Mar 11, 2026 • 4 min read

Pass-the-Hash over SMB – Shell Without a Password

Exploit NTLM authentication weaknesses by replaying captured password hashes over SMB to gain remote shell access without cracking credentials.

Mar 11, 2026 • 4 min read

SMB Remote Code Execution – psexec smbexec wmiexec

Exploit SMB with psexec, smbexec, and wmiexec for remote code execution. Covers authentication methods, shell spawning, and lateral movement techniques.

Mar 11, 2026 • 4 min read

3 steps

Vulnerabilities

Mar 11, 2026

Writeable SMB Share Exploitation – Hash Capture and Payloads

Mar 11, 2026 • 4 min read

SMB exploitation covers remote code execution, relay attacks, and credential-based access. EternalBlue (MS17-010) remains relevant on unpatched legacy systems, giving SYSTEM-level RCE through a memory corruption in SMBv1. Metasploit and standalone Python exploits handle this reliably on Windows 7, Server 2008, and older.

NTLM relay attacks with ntlmrelayx.py capture authentication from one host and forward it to another where SMB signing is not required. This bypasses the need to crack hashes entirely, executing commands, dumping SAM, or writing files on the relayed target. Combine with Responder or mitm6 to trigger authentication from targets on the network.

Credential brute-forcing with NetExec or Hydra tests passwords against SMB, while share-based access lets you read and write files on accessible shares. Writable shares in web roots, startup folders, or script directories turn file write into code execution. Password spraying across the domain through SMB is efficient since NetExec tests one password against all users in a single pass.