Browse Exploit & Auxiliary Modules

The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Open Source Vulnerability DataBase ID
Bugtraq ID
Full Text Search
Common Vulnerabilities Exposures ID
Microsoft Security Bulletin ID
 
Search Modules

SMB Login Check Scanner

This module will test a SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.


Rank

  • Normal

Authors

  • tebo < tebo [at] attackresearch.com >

References


Development


Similar Modules


Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/scanner/smb/smb_login
msf auxiliary(smb_login) > set RHOSTS [TARGET HOST RANGE]
msf auxiliary(smb_login) > run


Module Options

BLANK_PASSWORDS Try blank passwords for all users (default: true)
BRUTEFORCE_SPEED How fast to bruteforce, from 0 to 5 (default: 5)
PASS_FILE File containing passwords, one per line
PRESERVE_DOMAINS Respect a username that contains a domain name. (default: true)
RECORD_GUEST Record guest-privileged random logins to the database
RHOSTS The target address range or CIDR identifier
RPORT Set the SMB service port (default: 445)
SMBDomain SMB Domain (default: WORKGROUP)
SMBPass SMB Password
SMBUser SMB Username
STOP_ON_SUCCESS Stop guessing when a credential works for a host
THREADS The number of concurrent threads (default: 1)
USERPASS_FILE File containing users and passwords separated by space, one pair per line
USER_AS_PASS Try the username as the password for all users (default: true)
USER_FILE File containing usernames, one per line
VERBOSE Whether to print output for all attempts (default: true)
CHOST The local client address
CPORT The local client port
ConnectTimeout Maximum number of seconds to establish a TCP connection
DCERPC::ReadTimeout The number of seconds to wait for DCERPC responses
MaxGuessesPerService Maximum number of credentials to try per service instance. If set to zero or a non-number, this option will not be used.
MaxGuessesPerUser Maximum guesses for a particular username for the service instance. Note that users are considered unique among different services, so a user at 10.1.1.1:22 is different from one at 10.2.2.2:22, and both will be tried up to the MaxGuessesPerUser limit. If set to zero or a non-number, this option will not be used.
MaxMinutesPerService Maximum time in minutes to bruteforce the service instance. If set to zero or a non-number, this option will not be used.
NTLM::SendLM Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2 Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies Use a proxy chain
REMOVE_PASS_FILE Automatically delete the PASS_FILE on module completion
REMOVE_USERPASS_FILE Automatically delete the USERPASS_FILE on module completion
REMOVE_USER_FILE Automatically delete the USER_FILE on module completion
SMB::ChunkSize The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and SMB signing
SMB::Native_LM The Native LM to send during authentication
SMB::Native_OS The Native OS to send during authentication
SMB::VerifySignature Enforces client-side verification of server response signatures
SMBDirect The target port is a raw SMB service (not NetBIOS)
SMBName The NetBIOS hostname (required for port 139 connections)
SSL Negotiate SSL for outgoing connections
SSLVersion Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
ShowProgress Display progress messages during a scan
ShowProgressPercent The interval in percent that progress should be shown
WORKSPACE Specify the workspace for this module
DCERPC::fake_bind_multi Use multi-context bind calls
DCERPC::fake_bind_multi_append Set the number of UUIDs to append the target
DCERPC::fake_bind_multi_prepend Set the number of UUIDs to prepend before the target
DCERPC::max_frag_size Set the DCERPC packet fragmentation size
DCERPC::smb_pipeio Use a different delivery method for accessing named pipes (accepted: rw, trans)
SMB::obscure_trans_pipe_level Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level Place extra padding between headers and data (level 0-3)
SMB::pad_file_level Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size Maximum buffer size for pipe reads
SMB::pipe_read_min_size Minimum buffer size for pipe reads
SMB::pipe_write_max_size Maximum buffer size for pipe writes
SMB::pipe_write_min_size Minimum buffer size for pipe writes
TCP::max_send_size Maxiumum tcp segment size. (0 = disable)
TCP::send_delay Delays inserted before every send. (0 = disable)