How to Scan Windows Sharing Folder using nmap in Linux Operating System

By Posted on

This article has a specific subject. It discuss on how to scan Windows sharing folder. There is a tool in Linux operating system to achieve the purpose. It is a tool named ‘nmap’. The tools is available in Linux operating system and it works by typing it in the command line. The following is the step for scanning Windows sharing folder using nmap in Linux operating system :

1. First of all, check the tool or the command whether it is available in the operating system or not. Type the following command in the command line :

root@hostname:~# nmap
Nmap 7.60 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL : Input from list of hosts/networks
  -iR : Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile : Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags : Customize TCP scan flags
  -sI : Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b : FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p : Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports : Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports : Scan  most common ports
  --port-ratio : Scan ports more common than 
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity : Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=:  is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=: Show help about scripts.
            is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take

2. If it is not available, try to install the package or the tool. Depends on the Linux operating system, the installation method is also different.

3. Execute the tool or the command with the following additional parameter : 

nmap -pxxx,xxx --script smb-enum-shares ip-address

Using the above command pattern, just type the command : 

root@hostname:~# nmap -p139,445 --script smb-enum-shares 192.168.1.0/24
Starting Nmap 7.60 ( https://nmap.org ) at 2018-11-26 11:36 
Nmap scan report for 192.168.84.25
Host is up (0.0048s latency).
PORT    STATE  SERVICE
139/tcp closed netbios-ssn
445/tcp closed microsoft-ds
Nmap scan report for 192.168.84.69
Host is up (0.0023s latency).
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
Host script results:
| smb-enum-shares: 
|   account_used: guest
|   \\192.168.1.2\XXX: 
|     Type: XXXXX_XXXXXXX
|     Comment: recovered
|     Users: 1
|     Max Users: 
|     Path: C:\data
|     Anonymous access: 
|     Current user access: 
|   \\192.168.1.3\IPC$: 
|     Type: XXXXX_XXX_XXXXXX
|     Comment: IPC Service (LinkStation)
|     Users: 1
|     Max Users: 
|     Path: C:\tmp
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\192.168.1.3\backup: 
|     Type: STYPE_DISKTREE
|     Comment: backup_folder
|     Users: 0
|     Max Users: 
|     Path: C:\mnt\disk3\backup
|     Anonymous access: 
|     Current user access: 
|   \\192.168.1.4\mainframe: 
|     Type: STYPE_DISKTREE
|     Comment: 
|     Users: 0
|     Max Users: 
|     Path: C:\mnt\disk3\mainframe
|     Anonymous access: 
|_    Current user access: 
Nmap scan report for 192.168.1.254
Host is up (0.0045s latency).
PORT    STATE  SERVICE
139/tcp closed netbios-ssn
445/tcp closed microsoft-ds
Nmap done: 256 IP addresses (3 hosts up) scanned in 36.32 seconds
root@hostname:~#

There are two specific port in the above command execution. The first port, port 139 is known technically as ‘NBT over IP’. The other port, the port 445 is an ‘SMB over IP’. SMB stands for ‘Server Message Blocks’. There is also another Server Message Block in modern language which is the Common Internet File System. Those two ports are important for the operating system application-layer network protocol. Most usage of SMB involves computers running Microsoft Windows, which is ‘Microsoft Windows Network’ before the subsequent introduction of Active Directory. Primarily for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network. And as in the output of the command above, there are four Windows folder sharing definition.

Leave a Reply