Auditing SMB shares and their permissions
You list the domain’s file shares, recognise the hidden share, measure who can do what by trying access and reading permissions (smbcacls), prove that everyone can write to a share, download a share and search it for passwords and personal data, and write the gaps into a report. The hidden files are different in every lab.
Level 201 · 50 min
Most of the biggest data leaks in companies come not from complex attacks but from folders left open to everyone. Over the years a folder called "Shared" turns into a dump of scripts, backups, salary lists and forgotten passwords.
On Windows, file sharing uses the SMB protocol (port 445). Two layers of permission decide access to a share: the share permission (the guard at the door) and the file system permission (the lock on each room). The stricter of the two wins. The figure shows the two layers.
In this lab your credentials are ready in ~/.smb-auth (mode 600); smbclient -A ~/.smb-auth doesn’t ask for the password each time.
What you will do in this lesson
- List the shares
- Browse the Ortak share
- Closed doors: Muhasebe and IT$
- Read the permission list: smbcacls
- The write test: prove it and clean up
- Download the share
- Hunting for passwords
- Personal data
- The share audit report
- Short quiz
Skills you will earn
- Listing shares and hidden shares (smbclient -L)
- Proving share access with harmless tests
- Reading share and file ACLs (smbcacls)
- Taking a copy of a share (mget)
- Searching shares for plain passwords
- Finding personal data on shares
- Writing audit findings into a report
← Local administrator passwords: LAPS · Active Directory security: auditing and hardening · Group Policy (GPO) basics →
Start for free