# SMB ~ Manually Enumerating Samba Version

![SMB ~ Manually Enumerating Samba Version](https://cdn.hashnode.com/res/hashnode/image/upload/v1680985178383/b59b79bf-16ee-4703-b107-0198b2a9e8b8.jpeg)

I was recently trying as hard as I could to find out the `SAMBA` version that a machine was running. I exhausted most of the well known tools out there that were meant for SMB enumeration but I was still unable to uncover the target's samba version. After spending couple hours, this was how I was able to uncover the samba version! Hope this helps someone out there!

* * *

Attack Box's Min SMB Protocol
-----------------------------

Before I was able to negotiate with the target machine, I kept getting the following error.

    protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED
    

Couple google searches later, I realized that I had to configure my attack box to use the weaker and more insecure protocol version to be able to talk to the target. The following is how I achieved that.

Add the following line into `/etc/samba/smb.conf` with your fav text editor!

    client min protocol = LANMAN1

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-18.png)

Now I was all set for enumeration.

What I want to achieve manually
-------------------------------

In this following section, you can see that MSF is able to pick the version up. Whereas NMAP is not able to do the same. I would like to achieve this without the help of MSF at the end of this.

### Metasploit

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-21.png)

Samba 2.2.7a

### NMAP

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-19.png)

Where's my version at?

Manually Enumerating Samba Version
----------------------------------

There are 2 key things needed to perform this enumeration. **[smbver.sh](https://raw.githubusercontent.com/rewardone/OSCPRepo/master/scripts/recon_enum/smbver.sh)** and **Wireshark**. Firstly, setup a simple Wireshark capture. Then run the script as the following.

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-22.png)

    ./smbver.sh <target> <port>

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-23.png)

Once that's done, head to the capture and stop it. Then follow the TCP stream of the first SMB related capture.

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-24.png)

Once we start looking at a few related streams, the version should eventually be staring at us in plain text as seen below!

![SMB ~ Manually Enumerating Samba Version](/content/images/2021/04/image-25.png)

Unix.Samba 2.2.7a.MYGROUP

And that's how to enumerate samba versions manually without the help of Metasploit! Metasploit's a great tool, don't get me wrong. But you know...OSCP and stuff Hope this saves someone 3 hours of their time 😢~!

\-Nee