“SMB operates on port 445 and allows users to access shared resources on remote servers. However, legacy configurations and missing encryption make it highly vulnerable to eavesdropping and massive brute-force authentication attacks.”
Brute-forcing SMB against a domain account is usually the wrong move, and the reason is the account lockout policy: a handful of wrong guesses per user and you have locked out a real employee, generated an alert, and achieved nothing. The technique that actually works inverts it — one password, tried once against every account in the domain. SMB Password Cracking is about port 445, and getting the distinction between brute-force and password spraying right is most of what keeps it useful.
Network Enumeration
Reconnaissance first, mapped to MITRE ATT&CK as T1046 (Network Service Discovery). nmap -p 445 -sV establishes the dialect and OS version, which genuinely changes the plan: a Server 2008 host still offering SMBv1 is a different target — often with null-session enumeration available to pull the user list and, crucially, the domain’s lockout threshold — from a Server 2022 instance enforcing SMB signing and encryption.
The Brute-Force Matrix
SMB authentication runs through Windows, so every failed attempt writes Event ID 4625 to the security log. That is the constraint the tooling has to respect, and it is the argument for spraying over brute-forcing: read the lockout threshold, stay a couple of attempts under it, wait out the observation window, and try one carefully chosen password (Winter2026, CompanyName1) across the whole directory.
- NetExec (nxc): The current standard. Sprays concurrently across a subnet and, on a hit, tells you immediately whether the credential is a local admin somewhere with the
Pwn3d!flag — which turns credential validation and lateral-movement discovery into one pass. - Metasploit: The
smb_loginauxiliary module, cycling a dictionary and writing successful pairs into the framework database rather than leaving them in the console. - BruteSpray and Patator: Nmap output piped straight into authentication testing. Fast, indiscriminate, and a reason to confirm scope before launch — spray logic aimed at a whole
/16does not ask which hosts were in the engagement letter.
Defensive Controls
The mitigations are the sharper half. Zeek baselining normal file-sharing behaviour makes the burst from NetExec or BruteSpray stand out, and moving off legacy SMB to enforce SMB3 signing and encryption closes the relay and downgrade paths. The detection point the guide gets right, and worth stating precisely: the signal for spraying is not a pile of 4625s against one account — it is a single failure against many distinct accounts from one source in a short window. A per-account threshold rule never fires on it, because the attacker deliberately stays under exactly that threshold. You have to correlate across accounts by source, and most default rule sets do not.
Who Is This Book REALLY For?
- Red team operators: The syntax for a spray across a large forest with NetExec, and the reason to pace it against the lockout policy rather than the reason to fear the policy.
- Active Directory administrators: Confirmation that a lockout threshold stops brute-forcing and does nothing about spraying, so the real controls are strong passwords, MFA where it can be applied, and alerting on the one-failure-many-accounts pattern.
- SOC analysts: A reference for the artefacts SMB attacks generate, and specifically why correlating 4625 events across accounts by source IP catches what per-account rules miss.
The Bottom Line
SMB Password Cracking is a warning against equating internal with trusted. Port 445 is open across the whole estate by design, so weak or reused credentials are not a local exposure — they are a domain-wide one, and the attack that finds them is the quiet one your lockout policy was never built to see.
