Shared Folders
AIM: Find folders shared across the network
Enumerating SMB shared folders allows a penetration tester or attacker to list and access folders that are shared on a target system over the SMB (Server Message Block) protocol. These shared folders may contain sensitive files or misconfigurations that provide unauthorized access, potentially leading to further compromise of the network. The main purposes of enumerating SMB shared folders are:
Identifying Sensitive Data: Shared folders may store sensitive or confidential information like financial records, personal data, credentials, and configuration files.
Privilege Escalation: Misconfigured permissions on shared folders can allow unauthorized users to access or modify critical files, leading to privilege escalation.
Lateral Movement: Shared folders can provide access to data or scripts used for administrative tasks, enabling attackers to pivot to other systems in the network.
Reconnaissance: Information in shared folders can give insight into the target organization’s structure, network layout, or internal systems.
Credential Harvesting: Files in shared folders may contain plain text credentials or password hashes, which attackers can use for credential theft.
Impact of Enumerating Shared Folders
Once you have enumerated SMB shared folders, you can:
Access Shared Files: If permissions are misconfigured, you can access files that contain sensitive information or critical configurations. This may include personal information, company data, or scripts that can be modified.
Modify Files: If write permissions are granted, you can modify or upload files, potentially adding malicious scripts or binaries for future attacks.
Identify Misconfigurations: Identifying folders where permissions are set incorrectly (e.g., granting “Everyone” or “Anonymous” users full access) allows you to report misconfigurations to the client or exploit them during a red team exercise.
Data Exfiltration: Sensitive data found in shared folders can be exfiltrated. This includes documents, credentials, or any other valuable files that can be later analyzed or used for further attacks.
Privilege Escalation and Lateral Movement: Accessing configuration files or scripts can help escalate privileges or move laterally across the network. For example, you might find backup files containing hashes or configuration files with plain text credentials.
Password Hashes and Credentials: Files such as backup configurations or
.ps1(PowerShell) scripts may contain hard coded credentials or password hashes that you can use for further compromise.
Connect/List a Shared Folder
IPC$ Share
Access to the IPC$ share can be obtained through an anonymous null session, allowing for interaction with services exposed via named pipes. The utility enum4linux is useful for this purpose. Utilized properly, it enables the acquisition of:
Information on the operating system
Details on the parent domain
A compilation of local users and groups
Information on available SMB shares
The effective system security policy
This functionality is critical for network administrators and security professionals to assess the security posture of SMB (Server Message Block) services on a network. enum4linux provides a comprehensive view of the target system's SMB environment, which is essential for identifying potential vulnerabilities and ensuring that the SMB services are properly secured.
The above command is an example of how enum4linux might be used to perform a full enumeration against a target specified by target_ip.
Mitigating Security Risks Associated with SMB Shared Folder Enumeration
There are several best practices and configuration changes that can mitigate the risks associated with SMB shared folder enumeration:
1. Use Strong Access Control Policies
Review Permissions: Ensure that shared folders have appropriate permissions, limiting access to only the necessary users and groups. Avoid giving excessive permissions to groups like “Everyone” or “Anonymous.”
For example, restrict access to only the relevant users or departments for sensitive data.
2. Disable Unnecessary Shares
Remove Unused or Misconfigured Shares: If certain shares are no longer needed, disable or remove them. Also, avoid creating administrative shares (e.g.,
C$,ADMIN$) unless absolutely necessary.
3. Implement SMB Signing
Enable SMB Signing: SMB signing ensures the authenticity and integrity of the SMB communication, making it harder for attackers to launch Man-in-the-Middle (MitM) attacks.
This can be enforced using Group Policy:
4. Use Encrypted SMB (SMB 3.0)
SMB 3.0 Encryption: Use SMB 3.0 with encryption to prevent unauthorized access and protect SMB data in transit.
Encryption can be enforced at the folder level for sensitive shares by using the following command:
5. Block SMB Traffic on Public Networks
Limit SMB Exposure: Block SMB traffic on untrusted networks (e.g., the internet or external subnets) by using firewalls to block ports 137, 138, 139, and 445. Restrict SMB access to only trusted devices and internal networks.
In Windows Firewall, create inbound and outbound rules to block SMB:
6. Enforce Authentication
Disable Anonymous Access: Ensure that anonymous access to shares is disabled to prevent unauthenticated users from accessing sensitive data. This can be configured in Group Policy:
7. Regular Auditing and Monitoring
Audit Shared Folder Usage: Regularly audit shared folders to ensure that no unauthorized access has been granted. Use event logging to track access to sensitive shares and monitor for suspicious activity.
In Windows, configure auditing for file access via the following:
8. Disable SMBv1
Disable SMBv1: SMBv1 is insecure and deprecated. Disabling it eliminates the risks associated with its vulnerabilities, such as the EternalBlue exploit used in ransomware attacks like WannaCry.
Disable SMBv1 using PowerShell:
Last updated