Shares Hunting

As hporter, lets use Snaffler to see if we can get our hands on any sensitive informations. Copying it from our share to local DNN folder.

copy \\TSCLIENT\share\Snaffler.exe

Connection string: SiteSqlServer

ID=MyDNNUser;Password=MyDNNS3cureP@$$w0rD"

cdoUserName\ =\ "[email protected]"\t'EMAIL\ -\ USERNAME\ -\ IF\ AUTHENTICATION\ REQUIRED\r\nConst\ cdoPassword\ =\ "L337^p@$$w0rD"\t\t\t'

I get a few credentials, just keep notes for now. And we also see a list of shares that Snaffler browsed through.

Next, do the same share hunting using ssmalls credentials. Instead of Snaffler we use netexec

Now that we have the list of shares, lets use smbclient to log in and browse them:

Department Shares

After opening I see that the backup is done with the credentials of backupadm user:

Sysvol

Digging through the script we find another set of credentials: account:L337^p@$$w0rD. The one we took note of earlier when we found it using Snaffler.

I couldnt see anything in Bloodhound about the user account. According to the section this might be an old disabled account, but we got credentials regardless.

So far we got the credential pairs for 2 AD users. And the backupadm user.

PreviousActive DirectoryNextKerberoasting

Last updated