Windows

• linWinPwn
  • Good reference point for helpful options for script-based tools running off of Linux
• CrackMapExec
  • A little bit of everything (anything that can be ripped?), but geared towards AD
  • Docs: https://mpgn.gitbook.io/crackmapexec/
• mfasweep
  • Attempts to log in to various Microsoft services using a provided set of credentials + identify if MFA is enabled
• smbmap
  • Windows/Samba enum from a Linux host
• Snaffler
  • Search for juicy files in SMB shares
• enum4linux
  • Enumerate data from Windows and Samba hosts
• enum4linux-ng
  • Rewrite of enum4linux in Python that can output YAML or JSON
• Standard-ish Linux utilities:
  • smbclient
    • FTP-like Lan Manager client program
  • rpcclient
    • Tool for executing client side MS-RPC functions
  • nmblookup
    • NetBIOS over TCP/IP client used to lookup NetBIOS names
• rdpscan
  • Scan for "BlueKeep" vuln (CVE-2019-0708)
  • Analysis by Zero Day Initiative: here
  • Do note that exploitation is very finicky and can lead to BSOD if performed incorrectly. Use any exploits with caution.
• PowerHuntShares
  • Look for SMB shares with excessive privileges

Resources

• SMB Enumeration & Exploitation & Hardening
  • Helpful paper
• Searching SMB Share Files | SANS