# Vulnerability Discovery

> SMB vuln scans covering signing, EternalBlue, shares, and access control

- **URL:** https://hackindex.io/services/smb/vulnerability-discovery
- **Service:** [SMB](https://hackindex.io/services/smb.md)
- **Tags:** vulns, misconfig, risk
- **Published:** 2026-01-04
- **Updated:** 2026-03-29

SMB vulnerability discovery identifies configuration weaknesses and known CVEs that make SMB exploitation possible. SMB signing disabled or not required is the most impactful finding, since it enables NTLM relay attacks across the environment. NetExec, Nmap, and RunFinger.py detect signing status across large IP ranges quickly.

Null session and guest access allow unauthenticated enumeration and sometimes share access. Test with smbclient and enum4linux-ng using empty credentials and the Guest account. SMBv1 enabled (detected via Nmap or NetExec) exposes hosts to EternalBlue and related exploits, and is a finding even when patched since the protocol itself lacks modern security features.

Check for known CVEs by correlating the SMB dialect, OS version, and build number. Beyond EternalBlue, look for SMBGhost (CVE-2020-0796) on SMBv3.1.1 compression, PrintNightmare paths accessible via SMB, and ZeroLogon indicators on domain controllers. Exposed ADMIN$, C$, and IPC$ shares with weak credentials, shared local admin passwords, and missing account lockout policies compound these issues.

## Guides

- [Administrative SMB Share Exposure](https://hackindex.io/services/smb/vulnerability-discovery/administrative-smb-share-exposure.md): Identifies exposed Windows administrative shares (C$, ADMIN$, IPC$) via SMB, covering enumeration techniques, access risks, and misconfiguration assessment.
- [Detecting Known SMB Vulnerabilities](https://hackindex.io/services/smb/vulnerability-discovery/detecting-known-smb-vulnerabilities.md): Enumerate SMB services to identify unpatched vulnerabilities including EternalBlue (MS17-010), SMBGhost (CVE-2020-0796), and misconfigurations using Nmap and Metasploit.
- [Low-Privileged SMB Share Access](https://hackindex.io/services/smb/vulnerability-discovery/low-privileged-smb-share-access.md): Enumerate SMB shares with low-privileged credentials to identify misconfigurations, exposed sensitive data, and escalation paths via tools like smbclient and CrackMapExec.
- [MS17-010 EternalBlue - Detection](https://hackindex.io/services/smb/vulnerability-discovery/ms17-010-detection.md): Detect MS17-010 EternalBlue SMB vulnerability on Windows hosts using network scanning, traffic analysis, and patch verification techniques.
- [Overly Broad SMB Share Access](https://hackindex.io/services/smb/vulnerability-discovery/overly-broad-smb-share-access.md): Identifies misconfigured SMB shares with excessive permissions, covering enumeration techniques, access testing, and tools like smbclient and CrackMapExec.
- [Samba Version Weakness Detection](https://hackindex.io/services/smb/vulnerability-discovery/samba-version-weakness-detection.md): Identifies outdated or misconfigured Samba versions via banner grabbing and CVE mapping to uncover exploitable SMB vulnerabilities.
- [Backup Files on SMB Shares](https://hackindex.io/services/smb/vulnerability-discovery/sensitive-backups-on-smb-shares.md)
- [Sensitive Files on SMB Shares](https://hackindex.io/services/smb/vulnerability-discovery/sensitive-files-on-smb-shares.md)
- [SMB Guest Access Detection](https://hackindex.io/services/smb/vulnerability-discovery/smb-guest-access-detection.md)
- [SMB Signing Not Required Detection](https://hackindex.io/services/smb/vulnerability-discovery/smb-signing-not-required-detection.md): Identifies SMB servers with message signing disabled, enabling relay and MITM attacks. Covers detection via Nmap, Nessus, and manual verification methods.
- [SMBv1 Enabled Detection](https://hackindex.io/services/smb/vulnerability-discovery/smbv1-enabled.md)
- [Weak Password Policy via SMB](https://hackindex.io/services/smb/vulnerability-discovery/weak-password-policy-via-smb.md)
- [Writable SMB Shares Detection](https://hackindex.io/services/smb/vulnerability-discovery/writable-smb-shares-detection.md): Enumerate and identify writable SMB shares using tools like smbclient, CrackMapExec, and Metasploit to uncover misconfigured file share permissions.