Project 85: SMB Security Assessment

Module: Module 9: Post-Exploitation Detection & Active Directory Security  |  Level: Advanced  | 
Primary tool: smbclient + enum4linux-ng (free)  |  Estimated time: 2–4 hours

Objective: Audit SMB share permissions and null-session exposure.

Free lab environment

GOAD — Game of Active Directory (free, self-deployed) — https://github.com/Orange-Cyberdefense/GOAD

GOAD is a free, open-source, fully scripted vulnerable Active Directory lab you deploy yourself in Vagrant/VirtualBox — the standard free option for practicing AD security concepts legally in an isolated environment. A lighter free alternative is TryHackMe’s ‘Attacktive Directory’ room.

Lab workflow

1. Deploy Metasploitable2 or a GOAD lab deployment inside an isolated lab network — never point AD/SMB enumeration tools at a production or shared network.
2. Using smbclient + enum4linux-ng (free), enumerate what is reachable, with the specific goal of audit SMB share permissions and null-session exposure.
3. For each item enumerated without authentication, ask: should this really be reachable anonymously?
4. Identify the single most sensitive item exposed and write its specific remediation (a config change, not a vague ‘restrict access’).
5. If possible, apply that fix in your lab and re-run the enumeration to confirm the exposure is gone.
6. Summarize your findings as if briefing a system administrator who needs to act on them today.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• `smbclient -L` output listing accessible shares
• your written remediation for any share that allowed anonymous/null-session access

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.