In a network where several machines run SMB, which action BEST exploits this service to gain access?

• A. Exploit the SMB vulnerability by directly uploading a backdoor to the domain controller.
• B. Disable SMB on the target network to prevent further exposure.
• C. Use the Metasploit module auxiliary/scanner/smb/smb_enumshares to list all shared resources on the network and attempt to access them.
• D. Use a password spray attack across all SMB shares.

Answer: (C)

Understanding the SMB attack surface is the essential first step. SMB shares define what resources are exposed on the network and who can access them. By discovering which shares exist and what permissions they have, you reveal practical entry points—such as writable or guest-accessible shares, or shares with weak or misconfigured permissions. This reconnaissance guides what to test next and often leads to an actual foothold with the least amount of disruption.

Why this approach fits best here is that it directly maps out where access could be gained within the SMB ecosystem, rather than jumping straight to a single targeted exploit or defensive action. Enumerating shares is a practical, low-risk way to understand the network’s exposure and plan the next steps for gaining access ethically during a test.

The other options either aim at a single aggressive exploit against a highly sensitive component, which is not the most general or dependable path across an SMB-rich environment; a defensive action that stops exploitation rather than demonstrates a way to gain access; or a credential-based attack that depends on having valid credentials and may not be effective if defenses prevent rapid guessing.