Listen to this Post
Introduction:
Network shares are a foundational component of enterprise environments, yet they often represent a critical blind spot in cybersecurity defenses. Attackers relentlessly target these repositories to steal sensitive data and move laterally across a network. ShareHound, a new OpenGraph collector from SpecterOps, is designed to illuminate these shadowy access paths, transforming an organization’s understanding of share-level permissions and their role in identity-based attacks.
Learning Objectives:
- Understand the critical risk posed by unmanaged network share permissions and their role in privilege escalation.
- Learn how to leverage ShareHound to map and analyze share-level access at scale within an Active Directory environment.
- Identify key commands and methodologies for auditing, hardening, and defending network shares against modern adversary techniques.
You Should Know:
1. Installing and Configuring ShareHound
The primary method for deploying ShareHound is via its public GitHub repository. This tool is built to integrate seamlessly with the BloodHound ecosystem.
git clone https://github.com/SpecterOps/ShareHound.git cd ShareHound pip3 install -r requirements.txt
To use ShareHound, you must first configure it with the appropriate credentials for data collection. Create a `config.json` file specifying your domain, username, password, and the target BloodHound instance. The tool will then authenticate to the domain, enumerate all available SMB shares, and query their Access Control Lists (ACLs), structuring this data into a format that BloodHound can ingest and visualize, revealing complex attack paths that were previously invisible.
2. Enumerating Network Shares with PowerShell
Before deploying specialized tools, defenders can perform a basic reconnaissance of network shares using native Windows PowerShell commands. This helps establish a baseline.
Get-SmbShare | Get-SmbShareAccess | Select-Object Name, ScopeName, AccountName, AccessRight | Format-Table -AutoSize
This PowerShell command pipeline first retrieves all SMB shares on the local or a target computer using Get-SmbShare. It then pipes each share to Get-SmbShareAccess, which enumerates the ACL. The final `Select-Object` cmdlet filters the output to show the share name, the scope, the user or group with access, and their specific rights (e.g., Read, Change, FullControl). Running this across your estate provides a critical inventory of share permissions.
3. Leveraging BloodHound Cypher Queries for Share Analysis
Once ShareHound data is imported into BloodHound, you can use powerful Cypher queries to find dangerous relationships. This query finds users who can write to a share and have the permission to compromise the computer hosting it.
MATCH p=(u:User)-[r:WriteDacl|GenericAll|GenericWrite|Owns|AddMember|AddSelf|ForceChangePassword|AllExtendedRights]->(c:Computer)-[h:Hosts]->(s:Share) WHERE u.enabled = true RETURN p
This query traverses the graph to identify paths where a User (u) has a high-privilege relationship over a Computer (c), and that computer Hosts a Share (s). An attacker with control over the user account could compromise the host computer, potentially granting them unrestricted access to the files on the share, bypassing the share’s own ACLs.
4. Auditing Share Permissions with SharpHound
ShareHound complements the existing data collection of SharpHound, the official BloodHound collector. It’s crucial to run SharpHound with the correct flags to capture comprehensive data.
SharpHound.exe --CollectionMethods All,GPOLocalGroup
The `All` parameter instructs SharpHound to collect data on sessions, local admin rights, domain trusts, and group membership. The `GPOLocalGroup` parameter is particularly important as it can reveal how users are added to local groups (like “Remote Desktop Users”) via Group Policy, which can be a critical link in a chain to accessing a share-hosting server. Combining this dataset with ShareHound’s provides a holistic view of the attack surface.
5. Exploiting Weak Share Permissions: The Net Commands
An adversary discovering a share with misconfigured permissions, such as “Authenticated Users” having “Full Control,” can easily exploit it. The classic Windows `net` command suite is a primary tool for this.
net view \TARGETCOMPUTER /ALL net use Z: \TARGETCOMPUTER\DataShare copy C:\temp\malware.exe Z:\
The `net view` command lists all shares on the remote computer. The `net use` command is then used to map the vulnerable “DataShare” to a local drive letter (Z:). Finally, the attacker can copy malicious payloads to the share or exfiltrate sensitive data from it. This demonstrates how a single weak share ACL can lead to a direct compromise.
6. Hardening Share Permissions with icacls
Defenders must proactively harden share and NTFS permissions. The Windows `icacls` utility is the definitive tool for managing and repairing file system ACLs from the command line.
icacls "E:\SensitiveShare" /inheritance:r icacls "E:\SensitiveShare" /grant:r "DOMAIN\Data-RW-Group":(OI)(CI)M icacls "E:\SensitiveShare" /grant:r "DOMAIN\Data-RO-Group":(OI)(CI)R icacls "E:\SensitiveShare" /deny "Authenticated Users":(OI)(CI)W
This sequence first removes inherited permissions (/inheritance:r) to establish a clean slate. It then grants Modify rights to a specific “Data-RW-Group” and Read rights to a “Data-RO-Group” using Object Inherit (OI) and Container Inherit (CI) flags to ensure permissions apply to subfolders and files. Finally, it explicitly denies Write access to the broad “Authenticated Users” group, following the principle of least privilege.
7. Detecting Share Enumeration with Windows Event Logs
Proactive defense requires monitoring for reconnaissance activities. Windows Event ID 5145 in the Security log can track network share access attempts.
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5145; StartTime=(Get-Date).AddHours(-1)} | Where-Object {$_.Properties[bash].Value -like '\\'}
This PowerShell command fetches share-related access events from the last hour. A successful 5145 event will detail the share name accessed, the source IP address, and the user account. A high volume of these events from a single source, especially if it’s querying numerous shares, is a strong indicator of an attacker or a tool like ShareHound performing network share enumeration.
What Undercode Say:
- The abstraction of identity security to include network shares is a game-changer for attack path management.
- Defenders can no longer afford to treat file share permissions as a separate, lower-priority domain from Active Directory rights.
The introduction of ShareHound signifies a maturation in the identity security landscape. For years, tools like BloodHound have expertly mapped the complex relationships between users, groups, and computers. However, the critical link to the data itself—often stored on network shares—remained largely unmodeled. ShareHound bridges this final gap, creating a unified graph that encompasses both identity and data access. This forces a paradigm shift for blue teams; a user with “Read” access to a share containing sensitive intellectual property is now just as much a part of the attack graph as a user who is a member of “Domain Admins.” The analysis provided by this tool will inevitably lead to the discovery of “landmine” shares—seemingly low-privilege data repositories that, due to complex permission chains, serve as a direct conduit to domain compromise. Proactive organizations must now integrate share ACL analysis into their standard privilege access reviews.
Prediction:
The integration of network share data into attack path graphs will become a standard feature of Identity Threat Detection and Response (ITDR) platforms within two years. As attackers increasingly weaponize tools like ShareHound to find the path of least resistance, defenders will be forced to automate the continuous auditing and hardening of share permissions. This will lead to the development of new security policies that treat excessive share access as a Tier 1 security event, on par with unauthorized domain admin privilege escalation. The era of the network share as a silent partner in cyber attacks is officially over.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Specterops Sharehound – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
