← Back to Academy

Academy Node

Readable SMB Shares

Readable shares are SMB shares where anonymous or valid users can list/download files.

Beginner100 XPFinding

Why it matters

They often contain configs, scripts, backups, passwords, database strings, or usernames.

How to identify it

  • nxc shows READ
  • smbmap shows READ ONLY or READ WRITE
  • smbclient can list files

BloodHound indicators

  • Not a native BH edge unless modeled manually

NetExec commands

nxc smb 192.168.184.141 -u ba_low -p 'Password123' --shares

Linux commands

smbmap -H 192.168.184.141 -u ba_low -p 'Password123' -R
smbget -R smb://192.168.184.141/SHARE -U 'xutslabs.local/ba_low%Password123'

Expected output

  • READ permission
  • Downloaded files

Success looks like

  • Loot files locally
  • Find creds/usernames/configs

Failure looks like

  • Access denied
  • Empty share

Troubleshooting

  • Try domain format
  • Mount share locally
  • Use smbclient prompt

Common mistakes

  • Not recursive downloading
  • Not grep searching loot
  • Ignoring WRITE

Alternative attacks

  • LDAP enum
  • Web enum

What to try next

  • Search for passwords
  • Validate creds
  • Check scripts/configs

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.