notes

Home				CANT JOIN DOMAIN or USE GPE
Pro/Enterprise/Education	CAN JOIN DOMAIN or USE GPE

gpedit.msc	(Local) Group Policy Editor		Global
secpol.msc	Local Security Policy (Editor)		Local - brother of GPE

---------------------------------

# GUEST
#### Enable file and printer sharing
Control Panel\Network and Internet\Network and Sharing Center\Advanced sharing settings
Network discovery:              disable->enable (enables port discovery)
File and printer sharing:       disable->enable (enables pinging)

#### Enable Guest account
LSP -> Security Settings -> Local Policy -> Security Options -> Accounts: Guest account status | Disabled -> Enabled

#### Remove Guest from 'deny access from - policy'
LSP -> Security Settings -> Local Policy -> User Right Assignment -> Deny access to this computer from the network | Remove Guest

#### SAMR ENUMERATION
LSP -> Security Settings -> Local Policy -> Security Options -> Network access: Do not allow anonymous enumeration of SAM accounts | Enabled -> Disabled

# SHARE
Create folder and share it

---------------------------------

# shares
tree_id = conn.connectTree("IPC$")
conn.openFile(tree_id, "srvsvc")
shares = conn.listShares()
def list_shares(shares):
        for share in range(len(shares)):
                print(" --",shares[share]['shi1_netname'][:-1])

# read C$
conn.listPath("C$", "\*")

# transport.SMBTransport -> SMBConnection.connection
conn = SMBTransport(TARGET, filename="lsarpc", username=username, password=password)
dce = conn.get_dce_rpc()
dce.connect()
conn = conn.get_smb_connection()

# SMBConnection.connection -> transport.SMBTransport
conn = SMBConnection(TARGET, TARGET)
conn.login(username, password)
conn = SMBTransport(TARGET, filename="samr", smb_connection=conn)
dce = conn.get_dce_rpc()

# is the same
conn = SMBTransport(TARGET, filename="samr", username=username, password=password)
dce = conn.get_dce_rpc()
dce.connect()

conn = SMBConnection(TARGET, TARGET)
conn.login(username, password)
tree_id = conn.connectTree("IPC$")
file_id = conn.openFile(tree_id, "samr")

# guest
resp = hLsarOpenPolicy2(dce, POLICY_LOOKUP_NAMES)
policyHandle = resp['PolicyHandle']
hLsarLookupNames2(dce, policyHandle, (username,))

# SMB signing
is_signing = conn.isSigningRequired()
print("SMB signing\t\t:", "YES" if is_signing else "NO")