Hack Like a Pro: Linux Basics for the Aspiring Hacker, Part 22 (Samba) « Null Byte :: WonderHowTo

Welcome back, my aspiring hackers!Those of you who use Windows in a LAN environment understand that Windows machines can share directories, files, printers, etc. using "shares." This protocol dates back to the 1980s when the then dominant computer firm, IBM, developed a way for computers to communicate over the LAN by just using computer names rather than MAC or IP addresses.Eventually, Microsoft and Intel developed a similar protocol for file sharing, originally named NetBIOS, and eventually renamed Server Message Block (SMB). By 1992, Andrew Tridgell, reverse-engineered SMB forLinux/Unix (including Apple's Mac OS X) and named it Samba. It is a server-side implementation of SMB and requires no software to be installed on the client. Samba provides:File sharingNetwork printingAuthentication and authorizationName resolutionService announcement (browsing)Samba functionality is implemented by two daemons,smbdandnmbd. These daemons (services) are installed and run on nearly every distribution of Unix and Linux. Samba, like Windows NetBios/SMB, runs on ports 135, 137, and 445.Just like Window's SMB, Linux's Samba has been one of the weakest and most often exploited protocols. There is a long list of vulnerabilities and exploits that take advantage of Linux's Samba, and when I want to exploit a Linux system, one of the first things I test is Samba. Samba 3.6.3 and earlier versions allow anonymous users to gain root access throughSamba 's remote procedure call.The more we know and understand Samba, the better network admin's we will be and the betterLinux hackerswe will be. Let's take a little time to understand this essential and, often, very vulnerable protocol in Linux.Step 1: Locate SambaTo find Samba files in our Kali, let's just type:locate smbWhen you do so, you will see dozens of files with SMB or Samba in their name, including numerous Metasploit modules for exploiting Samba. Near the top of that list is the main configuration file for Samba,/etc/samba/smb.conf. Like nearly every application or daemon in Linux, there is a configuration file located in the/etcdirectory. These are simple text files that can be edited and saved to alter the configuration of the application or daemon. Samba is no different.Let's open that now with the text editor of your choice. In this case, I'll use Leafpad in Kali.kali > leafpad /etc/samba/smb.confAs you can see, this configuration file is well commented. For more information on configuring Samba, you can also type:kali > man sambaI should point out now that this configuration file uses two different types of comments. The first is the all familiar "#" , but it also the uses ";" too. You will see both in this configuration file.Step 2: Configure SambaSamba has a command that allows you to test the syntax of your configuration file. This is:kali > testparm -vWhen you type this command, it checks your parameters and syntax to see whether they are workable.It is important to note that whenever you make changes to this configuration file, you must restart Samba for them to be implemented. You can do this with:kali > service smb restartStep 3: Create a Samba UserSamba has its own password authentication system. You can create users with access to Samba, if they exist, in the/etc/passwdfile (in other words, they are a user on the system) with the command:kali > smbpasswd -a <username>As you can see, I have added myself, OTW, to the Samba user list with my password.Step 4: Setting the WorkGroupIf you want to connect to the workgroup from a Windows machine, you will need the name of the Windows workgroup. In the "Global Settings," you can see the default is set to workgroup but, of course, this should set to the name of the Windows workgroup that Samba will be connected to.Step 5: Accounting/LoggingNext, let's navigate down within the Global Settings to the "Debugging/Accounting" section.Here you can see we can set the location of the log file:log file = /var/log/samba/log.%mThe maximum log size (KB):max log size = 1000And whether to only use syslog to centralize our logging to a dedicated logging system:syslog only = noAmong many other things.Step 6: AuthenticationIf we navigate a bit lower in the Global Settings, we come to the "Authentication" section.Here we can set what type of server Samba will be:server role = standalone serverWhether Samba should obey/use pluggable authentication modules (PAM):obey pam restrictions = yesWhether Samba syncs passwords with the Linux/Unix password system:unix password sync = yesAnd finally, how Samba handles password setting.Step 7: Samba VariablesYou will notice that throughout the Samba configuration file, variables are used that begin with "%". For instance, in the logging section above, we saw this line:log file = /var/log/samba/log.%mThe "%m" at the end represents a variable. If we use the table below, we can see that the "%m" represents the "The client's NetBIOS name." If the NetBIOS name of the computer were "NullByte," this would mean that the logs would be found for that system at:log file = /var/log/samba/log.NullByteWhen we replaced the variable with the value of the NetBIOS name.Although there are far more changes we can make to this configuration file, in many cases the default setting will suffice in most circumstances, although not optimally. I'll be doing a second Samba tutorial in the near future where we will configure Samba for optimal file sharing, so keep coming back, my aspiring hackers.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 5 (Installing New Software)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 4 (Finding Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)News:What to Expect from Null Byte in 2015Hack Like a Pro:Windows CMD Remote Commands for the Aspiring Hacker, Part 1Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:Let Me Introduce MyselfCommunity Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingHow To:How Hackers Take Your Encrypted Passwords & Crack ThemCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 5 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal Hacker