/smb-exploitation

name: smb-exploitation
description: >
  Exploit remote SMB vulnerabilities for unauthenticated code execution on
  Windows hosts.
keywords:
  - MS08-067
  - MS17-010
  - EternalBlue
  - SMBGhost
  - smb exploit
  - exploit SMB
  - exploit this Windows host
  - smb-vuln
  - CVE-2008-4250
  - CVE-2017-0143
  - CVE-2020-0796
  - CVE-2009-3103
  - NetAPI exploit
  - eternal blue
  - eternal romance
  - eternal synergy
tools:
  - Metasploit (msfconsole)
  - impacket
  - nmap (for confirmation only)
opsec: high

SMB Remote Exploitation

You are helping a penetration tester exploit a confirmed SMB vulnerability for remote code execution. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[smb-exploitation] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

Scope Boundary

This skill covers SMB protocol exploitation — enumeration, authentication attacks, and share access. When you reach the boundary of this scope — whether through completing your methodology or discovering findings outside your domain — **STOP**.

Do not load or execute another skill. Do not continue past your scope boundary. Instead, return to the orchestrator with:

• What was found (vulns, credentials, access gained)
• Context to pass (injection point, target, working payloads, etc.)

The orchestrator decides what runs next. Your job is to execute this skill thoroughly and return clean findings.

**Stay in methodology.** Only use techniques documented in this skill. If you encounter a scenario not covered here, note it and return — do not improvise attacks, write custom exploit code, or apply techniques from other domains. The orchestrator will provide specific guidance or route to a different skill.

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• SMB vulnerability confirmed via nmap `smb-vuln*` scripts or equivalent
• Target OS and architecture identified (critical for target selection)
• Network access to target port 445
• Metasploit Framework installed (`msfconsole`)
• Listener port available (default 4444, or specify alternative)
• Attack machine IP reachable from target (check with `ip addr show tun0` for

VPN, or appropriate interface)

Step 1: Assess

If not already provided by the orchestrator or conversation context, determine:

1. **Which vulnerability?** Check engagement state or ask — MS08-067, MS17-010, MS09-050, or SMBGhost 2. **Target OS and architecture?** Windows version, service pack, 32-bit vs 64-bit — critical for exploit target selection 3. **Attack machine IP?** Run `ip -4 addr show tun0` (or appropriate interface) to get the listener address

Vulnerability-to-OS Compatibility Matrix

| CVE | Vulnerability | Affected OS | Notes | |-----|--------------|-------------|-------| | CVE-2008-4250 | MS08-067 | XP SP0-SP3, Server 2003 SP0-SP2, Vista SP0-SP1, Server 2008 pre-SP2 | Most reliable on XP/2003 | | CVE-2009-3103 | MS09-050 | Vista SP1-SP2, Server 2008 SP1-SP2 | SMBv2 negotiation bug | | CVE-2017-0143 | MS17-010 (EternalBlue) | XP through Server 2016 (unpatched) | Unstable on XP/2003 32-bit | | CVE-2020-0796 | SMBGhost | Windows 10 1903/1909, Server v1903/v1909 | SMBv3 compression |

Skip this step if the orchestrator already provided this information.

Step 2: Select Exploit and Target

MS08-067 (CVE-2008-4250)

**Metasploit module:** `exploit/windows/smb/ms08_067_netapi`

Preferred for Windows XP and Server 2003. More stable than EternalBlue on these older systems.

**Target selection — critical for reliability:**

| Target ID | OS | |-----------|----| | 0 | Automatic Targeting | | 1 | Windows 2000 Universal | | 2 | Windows XP SP0/SP1 Universal | | 3 | Windows XP SP2 English (NX) | | 4 | Windows XP SP3 English (NX) | | 5 | Windows 2003 SP0 Universal | | 6 | Windows XP SP2/SP3 English (AlwaysOn NX) | | 7 | Windows 2003 SP1 English (NO NX) | | 8 | Windows 2003 SP1 English (NX) | | 9 | Windows 2003 SP2 English (NO NX) | | 10 | Windows 2003 SP2 English (NX) |

**Decision logic:**

• If OS is "Windows XP" and SP2 or SP3: use **target 6** (handles both, NX-aware)
• If OS is "Windows XP" and SP0/SP1: use **target 2**
• If OS is "Windows 2003" and SP1: use **target 8** (NX) or **target 7** (no NX)
• If OS is "Windows 2003" and SP2: use **target 10** (NX) or **target 9** (no NX)
• If OS is "Windows 2000": use **target 1**
• If unsure about NX: try NX-enabled target first — it works on both, the

reverse doesn't

• If unsure about SP: use **target 0** (automatic) — less reliable but attempts

fingerprinting

• For non-English targets: use **target 0** (automatic) and note that language-

specific targets exist in Metasploit (check `show targets` for full list)

**Payload selection:**

• Default: `windows/shell_reverse_tcp` — simple, reliable, no staging issues
• Alternative: `windows/meterpreter/reverse_tcp` — more features but staged

payload can fail on slow/filtered links

• If port 4444 is filtered: try 443 or 80 as LPORT

MS17-010 / EternalBlue (CVE-2017-0143)

**Metasploit modules (choose based on target OS):**

| Module | Best For | Notes | |--------|------