Skip to content

Faster SMB Share Enumeration#2

Merged
aconite33 merged 6 commits intomainfrom
faster-share-enum
May 20, 2025
Merged

Faster SMB Share Enumeration#2
aconite33 merged 6 commits intomainfrom
faster-share-enum

Conversation

@Mercury0
Copy link
Copy Markdown
Collaborator

Description

This PR implements the following enhancements to the SMB protocol handler:

  • Skip SMB write checking on NETLOGON and SYSVOL shares if user has read/write access to C$ and target host is a domain controller. Infer DA-equivalent permissions
  • Leverages openFile instead of createFile on the share root using the FILE_WRITE_DATA access mask which does not write file artifacts to disk, unlike the original implementation.
  • Addition of randomized jitter before enumerating shares.
  • Avoid additional C$ access probe when --shares is passed as a CLI arg if permissions already known.

Type of change

  • OPSEC enhancement and performance boost

How Has This Been Tested?

Local testing

Screenshots:

Top = Patched share enumeration behavior
Bottom = Default share enumeration behavior
image
image

Checklist:

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)

@Mercury0 Mercury0 added the enhancement New feature or request label May 12, 2025
@Mercury0 Mercury0 requested a review from aconite33 May 12, 2025 18:36
@aconite33 aconite33 merged commit 9b4116c into main May 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants