Exploitation

SMB NTLM Relay – Hash Relay to Shell

Pass-the-Hash over SMB – Shell Without a Password

SMB Remote Code Execution – psexec smbexec wmiexec

Vulnerabilities

3 steps

• EternalBlue MS17-010 – SMB RCE
• PrintNightmare – Print Spooler RCE to SYSTEM
• SambaCry CVE-2017-7494 – Samba RCE via Writeable Share

Writeable SMB Share Exploitation – Hash Capture and Payloads