# Exploitation

> SMB shells via relay, PtH, RCE exploits, and share abuse

- **URL:** https://hackindex.io/services/smb/exploitation
- **Service:** [SMB](https://hackindex.io/services/smb.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-11
- **Updated:** 2026-03-29

SMB exploitation covers remote code execution, relay attacks, and credential-based access. EternalBlue (MS17-010) remains relevant on unpatched legacy systems, giving SYSTEM-level RCE through a memory corruption in SMBv1. Metasploit and standalone Python exploits handle this reliably on Windows 7, Server 2008, and older.

NTLM relay attacks with ntlmrelayx.py capture authentication from one host and forward it to another where SMB signing is not required. This bypasses the need to crack hashes entirely, executing commands, dumping SAM, or writing files on the relayed target. Combine with Responder or mitm6 to trigger authentication from targets on the network.

Credential brute-forcing with NetExec or Hydra tests passwords against SMB, while share-based access lets you read and write files on accessible shares. Writable shares in web roots, startup folders, or script directories turn file write into code execution. Password spraying across the domain through SMB is efficient since NetExec tests one password against all users in a single pass.

## Guides

- [SMB NTLM Relay – Hash Relay to Shell](https://hackindex.io/services/smb/exploitation/ntlm-relay.md): Exploit SMB NTLM relay attacks to capture and relay authentication hashes, escalating from network access to remote code execution via compromised credentials.
- [Pass-the-Hash over SMB – Shell Without a Password](https://hackindex.io/services/smb/exploitation/pass-the-hash.md): Exploit NTLM authentication weaknesses by replaying captured password hashes over SMB to gain remote shell access without cracking credentials.
- [SMB Remote Code Execution – psexec smbexec wmiexec](https://hackindex.io/services/smb/exploitation/remote-code-execution.md): Exploit SMB with psexec, smbexec, and wmiexec for remote code execution. Covers authentication methods, shell spawning, and lateral movement techniques.
- [Vulnerabilities](https://hackindex.io/services/smb/exploitation/vulnerabilities.md)
  - [EternalBlue MS17-010 – SMB RCE](https://hackindex.io/services/smb/exploitation/vulnerabilities/eternalblue-ms17-010-smb-rce.md): Exploits the MS17-010 SMB vulnerability using EternalBlue to achieve unauthenticated remote code execution on unpatched Windows systems via port 445.
  - [PrintNightmare – Print Spooler RCE to SYSTEM](https://hackindex.io/services/smb/exploitation/vulnerabilities/printnightmare-print-spooler-rce-to-system.md): Exploits CVE-2021-1675/34527 via Windows Print Spooler to achieve RCE and SYSTEM-level privilege escalation through malicious DLL injection over SMB.
  - [SambaCry CVE-2017-7494 – Samba RCE via Writeable Share](https://hackindex.io/services/smb/exploitation/vulnerabilities/sambacry-cve-2017-7494-samba-rce-via-writeable-share.md)
- [Writeable SMB Share Exploitation – Hash Capture and Payloads](https://hackindex.io/services/smb/exploitation/writeable-share-exploitation.md)