> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445.md). # SMB - 445 SMB 枚举和利用笔记，涵盖共享、空会话、RID 暴力破解、PsExec、NetExec、CrackMapExec、SMBMap 和 EternalBlue。 SMB 是 Windows 环境中最有价值的服务之一。检查空会话、共享、签名、RID 暴破、可读文件、凭据复用、管理访问权限，以及 MS17-010 等已知漏洞。 ## 说明
CrackMapExec枚举主机、用户、共享、凭据和提权访问权限。CrackMapExec（SMB 工具）
PsExec使用凭据或 NTLM 哈希远程执行命令。PsExec（SMB 工具）
SMBMap审查共享权限、列出文件并下载目标。SMBMap（SMB 工具）
smbclient从命令行列出并访问 SMB 共享。smbclient（SMB 工具）
rpcclient使用空会话和 RPC 调用枚举用户和组。rpcclient（SMB 工具）
NetExec枚举 AD 用户并查找敏感描述信息。NetExec（SMB 工具）
SMBServer托管一个临时 SMB 共享用于文件传输。SMBServer（SMB 工具）
EternalBlue在易受攻击的 SMB 目标上验证并利用 MS17-010。EternalBlue 利用
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/ports-and-services/smb-445.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.