Skip to content
HackIndex.io

SMB:

Vulnerability Discovery

SMB vuln scans covering signing, EternalBlue, shares, and access control

13 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
13 guides

Administrative SMB Share Exposure

Identifies exposed Windows administrative shares (C$, ADMIN$, IPC$) via SMB, covering enumeration techniques, access risks, and misconfiguration assessment.

Detecting Known SMB Vulnerabilities

Enumerate SMB services to identify unpatched vulnerabilities including EternalBlue (MS17-010), SMBGhost (CVE-2020-0796), and misconfigurations using Nmap and Metasploit.

Low-Privileged SMB Share Access

Enumerate SMB shares with low-privileged credentials to identify misconfigurations, exposed sensitive data, and escalation paths via tools like smbclient and CrackMapExec.

MS17-010 EternalBlue - Detection

Detect MS17-010 EternalBlue SMB vulnerability on Windows hosts using network scanning, traffic analysis, and patch verification techniques.

Overly Broad SMB Share Access

Identifies misconfigured SMB shares with excessive permissions, covering enumeration techniques, access testing, and tools like smbclient and CrackMapExec.

Samba Version Weakness Detection

Identifies outdated or misconfigured Samba versions via banner grabbing and CVE mapping to uncover exploitable SMB vulnerabilities.

Backup Files on SMB Shares

Sensitive Files on SMB Shares

SMB Guest Access Detection

SMB Signing Not Required Detection

Identifies SMB servers with message signing disabled, enabling relay and MITM attacks. Covers detection via Nmap, Nessus, and manual verification methods.

SMBv1 Enabled Detection

Weak Password Policy via SMB

Writable SMB Shares Detection

Enumerate and identify writable SMB shares using tools like smbclient, CrackMapExec, and Metasploit to uncover misconfigured file share permissions.

SMB vulnerability discovery identifies configuration weaknesses and known CVEs that make SMB exploitation possible. SMB signing disabled or not required is the most impactful finding, since it enables NTLM relay attacks across the environment. NetExec, Nmap, and RunFinger.py detect signing status across large IP ranges quickly.

Null session and guest access allow unauthenticated enumeration and sometimes share access. Test with smbclient and enum4linux-ng using empty credentials and the Guest account. SMBv1 enabled (detected via Nmap or NetExec) exposes hosts to EternalBlue and related exploits, and is a finding even when patched since the protocol itself lacks modern security features.

Check for known CVEs by correlating the SMB dialect, OS version, and build number. Beyond EternalBlue, look for SMBGhost (CVE-2020-0796) on SMBv3.1.1 compression, PrintNightmare paths accessible via SMB, and ZeroLogon indicators on domain controllers. Exposed ADMIN$, C$, and IPC$ shares with weak credentials, shared local admin passwords, and missing account lockout policies compound these issues.