# Network Service Attacks

> Attack non-web network services surfaced by recon. Load when nmap shows services like SMB (445), RPC (135), LDAP (389), SNMP (161), NFS (2049), SMTP (25), FTP (21), RDP (3389), databases (3306/5432/1433/6379/27017). Signals: open non-HTTP ports, service+version banners.

- Skill: `noorqureshi/network-service-attacks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/network-service-attacks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/network-service-attacks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/network-service-attacks

---


# Network service enumeration & attack

## When it applies
Recon exposed non-web services. Each is its own attack surface: anonymous access, default/weak
creds, known-CVE versions, and info leaks that feed the next step. (See `recon-arsenal` for the
discovery arsenal; this is the exploit routing per service.)

## Why it works
Internal-style services are frequently deployed with defaults, anonymous binds, or no auth
because they were "not meant to be exposed". Version banners map straight to public exploits.

## Method
1. **Always version-map first** — the exact product+version is the fastest lead (`nmap -sCV`).
2. **Route by service**:
   - **SMB (445)**: `nxc smb <ip> -u '' -p ''` (null session), `enum4linux-ng`, list shares
     (`smbclient -L //ip -N`), check for `EternalBlue`/signing; spray creds with netexec.
   - **LDAP (389/636)**: anonymous bind dump (`ldapsearch -x -H ldap://ip -b <base>`) → users.
   - **SNMP (161)**: `snmpwalk -v2c -c public ip` — leaks processes, users, routes, sometimes creds.
   - **NFS (2049)**: `showmount -e ip`; mount world-readable exports, check `no_root_squash`.
   - **SMTP (25)**: `VRFY`/`RCPT` user enumeration.
   - **DBs**: try default creds; Redis (6379) often unauth (→ `web-ssrf-gopher-redis-rce` if internal).
3. **Map version → CVE**: `searchsploit <product version>`; verify before firing.

## Gotchas
- Null/anonymous first — it's free and frequently works before any exploit.
- SNMP community `public`/`private` and defaults are the quiet win people skip.
- Confirm a CVE actually matches the exact version; wrong minor version = wasted exploit.

## Verify success
Access or credentials from a service (share contents, LDAP users, a DB login), or confirmed
exploitation of a versioned CVE — feeding foothold/privesc.

## References
Service-enum references (HackTricks, 0xdf); netexec wiki; GTFOBins/searchsploit.