# Report

POWERHUNTSHARES
demo.local

## Interesting Files

This section provides a list of files that may contain passwords or sensitive data, or may be abused for remote code execution.
Interesting Files Found
83
(65 unique file names)
Loading...
Export | Clear

File Count | File Name | Category | File Paths
--- | --- | --- | ---
5 | program files | Binaries | \\demo.local\C$\program files \\demo.local\C\program files \\2012SERVERSCCM.demo.local\C$\program files \\demo.local\ADMIN$\program files \\2012SERVERSCCM.demo.local\ADMIN$\program files
3 | program files (x86) | Binaries | \\demo.local\C$\program files (x86) \\demo.local\C\program files (x86) \\2012SERVERSCCM.demo.local\C$\program files (x86)
3 | system | Secret | \\2012SERVERSCCM.demo.local\C$\system \\demo.local\ADMIN$\system \\2012SERVERSCCM.demo.local\ADMIN$\system
2 | backup | Backup | \\demo.local\C$\backup \\demo.local\C\backup
2 | bfsvc.exe | Binaries | \\demo.local\ADMIN$\bfsvc.exe \\2012SERVERSCCM.demo.local\ADMIN$\bfsvc.exe
2 | explorer.exe | Binaries | \\demo.local\ADMIN$\explorer.exe \\2012SERVERSCCM.demo.local\ADMIN$\explorer.exe
2 | helppane.exe | Binaries | \\demo.local\ADMIN$\helppane.exe \\2012SERVERSCCM.demo.local\ADMIN$\helppane.exe
2 | downloaded program files | Binaries | \\demo.local\ADMIN$\downloaded program files \\2012SERVERSCCM.demo.local\ADMIN$\downloaded program files
2 | regedit.exe | Binaries | \\demo.local\ADMIN$\regedit.exe \\2012SERVERSCCM.demo.local\ADMIN$\regedit.exe
2 | splwow64.exe | Binaries | \\demo.local\ADMIN$\splwow64.exe \\2012SERVERSCCM.demo.local\ADMIN$\splwow64.exe
2 | winhlp32.exe | Binaries | \\demo.local\ADMIN$\winhlp32.exe \\2012SERVERSCCM.demo.local\ADMIN$\winhlp32.exe
2 | write.exe | Binaries | \\demo.local\ADMIN$\write.exe \\2012SERVERSCCM.demo.local\ADMIN$\write.exe
2 | hh.exe | Binaries | \\demo.local\ADMIN$\hh.exe \\2012SERVERSCCM.demo.local\ADMIN$\hh.exe
1 | unattend-base64.xml | Secret | \\2012SERVERSCCM.demo.local\files\unattend-base64.xml
1 | unattend-cleartext.xml | Secret | \\2012SERVERSCCM.demo.local\files\unattend-cleartext.xml
1 | sysprep.inf | Secret | \\2012SERVERSCCM.demo.local\files\sysprep.inf
1 | private.crt | Secret | \\2012SERVERSCCM.demo.local\files\private.crt
1 | sssd.conf | Secret | \\2012SERVERSCCM.demo.local\files\sssd.conf
1 | smb.conf | Secret | \\2012SERVERSCCM.demo.local\files\smb.conf
1 | krb5.conf | Secret | \\2012SERVERSCCM.demo.local\files\krb5.conf
1 | .htpasswd | Secret | \\2012SERVERSCCM.demo.local\files\.htpasswd
1 | .pgpass | Secret | \\2012SERVERSCCM.demo.local\files\.pgpass
1 | grub.conf | Secret | \\2012SERVERSCCM.demo.local\files\grub.conf
1 | .fetchmailrc | Secret | \\2012SERVERSCCM.demo.local\files\.fetchmailrc
1 | .git-credentials | Secret | \\2012SERVERSCCM.demo.local\files\.git-credentials
1 | .netrc | Secret | \\2012SERVERSCCM.demo.local\files\.netrc
1 | printers.xml | Secret | \\2012SERVERSCCM.demo.local\files\printers.xml
1 | remmina.pref | Secret | \\2012SERVERSCCM.demo.local\files\remmina.pref
1 | .remmina | Secret | \\2012SERVERSCCM.demo.local\files\.remmina
1 | en_sql_server_2014_developer_edition_x64_dvd_3940406.iso | SystemImage | \\2012SERVERSCCM.demo.local\C$\en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
1 | mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso | SystemImage | \\2012SERVERSCCM.demo.local\C$\mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
1 | grub.cfg | Secret | \\2012SERVERSCCM.demo.local\files\grub.cfg
1 | dbvis.xml | Secret | \\2012SERVERSCCM.demo.local\files\dbvis.xml
1 | services.xml | Secret | \\2012SERVERSCCM.demo.local\files\services.xml
1 | groups.xml | Secret | \\2012SERVERSCCM.demo.local\files\groups.xml
1 | context.xml | Secret | \\2012SERVERSCCM.demo.local\files\context.xml
1 | dbxdrivers.ini | Secret | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini
1 | pureftpd.passwd | Secret | \\2012SERVERSCCM.demo.local\files\pureftpd.passwd
1 | config.xml | Secret | \\2012SERVERSCCM.demo.local\files\config.xml
1 | jboss-cli.xml | Secret | \\2012SERVERSCCM.demo.local\files\jboss-cli.xml
1 | machine.config | Secret | \\2012SERVERSCCM.demo.local\files\machine.config
1 | startup-config.txt | Secret | \\2012SERVERSCCM.demo.local\files\startup-config.txt
1 | running-config.txt | Secret | \\2012SERVERSCCM.demo.local\files\running-config.txt
1 | my.cnf | Secret | \\2012SERVERSCCM.demo.local\files\my.cnf
1 | my.key | Secret | \\2012SERVERSCCM.demo.local\files\my.key
1 | php.ini | Secret | \\2012SERVERSCCM.demo.local\files\php.ini
1 | putty.reg | Secret | \\2012SERVERSCCM.demo.local\files\putty.reg
1 | server.xml | Secret | \\2012SERVERSCCM.demo.local\files\server.xml
1 | drives.xml | Secret | \\2012SERVERSCCM.demo.local\files\drives.xml
1 | shadow | Secret | \\2012SERVERSCCM.demo.local\files\shadow
1 | tnsnames.ora | Secret | \\2012SERVERSCCM.demo.local\files\tnsnames.ora
1 | tomcat-users.xml | Secret | \\2012SERVERSCCM.demo.local\files\tomcat-users.xml
1 | sitemanager.xml | Secret | \\2012SERVERSCCM.demo.local\files\sitemanager.xml
1 | variables.dat | Secret | \\2012SERVERSCCM.demo.local\files\variables.dat
1 | setting.ini | Secret | \\2012SERVERSCCM.demo.local\files\setting.ini
1 | winscp.ini | Secret | \\2012SERVERSCCM.demo.local\files\winscp.ini
1 | wp-config.php | Secret | \\2012SERVERSCCM.demo.local\files\wp-config.php
1 | app.config | Secret | \\2012SERVERSCCM.demo.local\files\app.config
1 | web.config | Secret | \\2012SERVERSCCM.demo.local\files\web.config
1 | example.dtsx | Secret | \\2012SERVERSCCM.demo.local\files\example.dtsx
1 | example.rdp | Secret | \\2012SERVERSCCM.demo.local\files\example.rdp
1 | vnc.ini | Secret | \\2012SERVERSCCM.demo.local\files\vnc.ini
1 | scheduledtasks.xml | Secret | \\2012SERVERSCCM.demo.local\files\scheduledtasks.xml
1 | standalone.xml | Secret | \\2012SERVERSCCM.demo.local\files\standalone.xml
1 | bootstrap.ini | Secret | \\2012SERVERSCCM.demo.local\files\bootstrap.ini

## Summary Report

Testing was conducted between 11/07/2024 08:08:31 and 11/07/2024 08:10:31 to identify network shares configured with excessive privileges hosted on computers joined to the demo.local domain. In total, 13 critical, 6 high, 6 medium, and 22 low risk ACE (Access Control Entry) configurations were discovered across 16 shares, hosted by 2 computers in the demo.local Active Directory domain. Overall, 83 interesting files were found accessible to all domain users that could potentially lead to unauthorized data access or remote code execution. The affected shares were found hosting 53 files that may contain passwords and 0 files that may contain sensitive data. 143 credentials were recovered from 50 of the discovered 53 secrets files.
The section provides a summary of the affected assets, findings, data exposure, share creation timelines, peer comparison and general recommendations.
Finding Exposure Summary
Critical
13
findings
High
6
findings
Medium
6
findings
Low
22
findings
More details available in the Networks, Computers, Shares, and ACEs sections.
Data Exposure Summary
Interesting
83
files found
Sensitive
0
files found
Secrets
53
files found
Extracted
143
secrets (50 files)
More details are available in the Extracted Secrets, and Interesting Files sections.
Asset Exposure Summary
47 ACL entries, on 16 shares, hosted by 2 computers were found configured with excessive privileges on the demo.local domain. In this environment, we observed a total of 19 application instances, with 4 unique application names primarily focused on operating systems, configuration management, virtualization, and security. The Windows Operating System had the highest count with 10 instances (52.63% of the total), followed by Microsoft System Center Configuration Manager with 3 instances (15.79% of the total).
Networks
1
affected
Computers
2
affected
Shares
16
affected
ACEs
47
affected
Note: Application fingerprints were generated using an experimental version of the LLM-based application fingerprinting function. As a result, some application classifications may not be accurate.
Affected Asset Peer Comparison
Below is a comaprison between the percent of affected assets in this environment and the average percent of affected assets observed in other environments. The percentage is calculated based on the total number of live assets discovered for each asset type. Based on the volume of ACEs configured with excessive privileges, this is environment was less secure compared to the average.
Share Creation Timeline
Below is a time series chart to help provide a sense of when shares were created and at what point critical and high risk shares were introduced into the environment. By reading the chart left to right, you can see that shares were created in this environment between 10/27/1991 and 09/25/2024. You can zoom into any section of the chart by clicking or using the chart controls in the upper right hand corner of the chart. Shares configured with critical risk ACEs were created between 07/26/2012 and 07/26/2012. Shares configured with high risk ACEs were created between 07/26/2012 and 08/05/2020. The red and purple trend lines reflect the cumulative number of critical and high risk shares in the environment so you can easily observe when/if they were introduced. The chart also includes two horizontal lines. The "avg" line shows the average number of created shares and everything above the "+2 Std Dev" line is considered anomolous in the context of this report. 1 anomalies were found that represent days when share creation counts were twice the standard deviation.
Remediation & Prioritization Recommendations
Remediate share ACEs by risk level, starting with critical and high risks. Review the share creation timeline and share name details from other sections for additional context. Consider remediating mutliple ACEs at one time based on natural share groupings to reduce the number of remediation tasks.
Group Examples:

- Group ACE remediation tasks by folder groups, which contain exactly the same file listing.
- Group ACE remediation tasks by share names with a high similarity scores.

Remediating ACEs by group may reduce remediation tasks by as much as 83% for this environment. The chart below shows the task savings.
More details are available in the Folder Group, and Share Names sections.

## Computers

This section provides information for computers hosting shares configured with excessive privileges. 13 computers were found in the demo.local Active Directory domain, 2 responded to ping requests, 2 had port 445 open, and 2 were found hosting shares configured with excessive privileges.
Affected Computers
2
Loading...
Export | Clear

Computer Name Computer Name is the name of the computer. | Operating System OS is the operating system of the computer. | Risk Level Risk Level relfects the exposure of credentials and sensitive data. | Share Count Share Count is the number of shares hosted on the same computer. | Interesting Files Interesting Files are filenames that may be sensitive.
--- | --- | --- | --- | ---

demo.local

Windows Server 2012 Standard

22 Critical

\\demo.local\C$
\\demo.local\backup
\\demo.local\inetpub
\\demo.local\sccm
\\demo.local\logs
\\demo.local\sql
\\demo.local\C
\\demo.local\apps
\\demo.local\wwwroot
\\demo.local\ADMIN$

system
backup
backup
bfsvc.exe
explorer.exe
helppane.exe
hh.exe
regedit.exe
splwow64.exe
winhlp32.exe
write.exe
program files
program files
program files
program files (x86)
program files (x86)
downloaded program files

2012SERVERSCCM.demo.local

Windows Server 2012 Standard

24 Critical

\\2012SERVERSCCM.demo.local\C$
\\2012SERVERSCCM.demo.local\ADMIN$
\\2012SERVERSCCM.demo.local\CtxSTShare
\\2012SERVERSCCM.demo.local\files
\\2012SERVERSCCM.demo.local\REMINST
\\2012SERVERSCCM.demo.local\SophosUpdate

bootstrap.ini
context.xml
dbxdrivers.ini
pureftpd.passwd
config.xml
jboss-cli.xml
machine.config
startup-config.txt
running-config.txt
my.cnf
my.key
php.ini
putty.reg
system
system
server.xml
shadow
standalone.xml
tnsnames.ora
tomcat-users.xml
sitemanager.xml
variables.dat
setting.ini
winscp.ini
wp-config.php
app.config
web.config
example.dtsx
example.rdp
vnc.ini
scheduledtasks.xml
groups.xml
drives.xml
services.xml
printers.xml
unattend-base64.xml
unattend-cleartext.xml
sysprep.inf
private.crt
sssd.conf
smb.conf
krb5.conf
.htpasswd
.pgpass
grub.cfg
grub.conf
.fetchmailrc
.git-credentials
.netrc
dbvis.xml
remmina.pref
.remmina
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
bfsvc.exe
explorer.exe
helppane.exe
hh.exe
regedit.exe
splwow64.exe
winhlp32.exe
write.exe
program files
program files
program files (x86)
downloaded program files

## Identities

The section provides the affected identities.3 identities were discovered across shares in the demo.local Active Directory domain. 2 were owners and 1 were assigned privileges.
Note: Within the context of this report, all read and write access the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups are considered excessive privileges, because all provide domain users access to the affected shares due to privilege inheritance.
Affected Identities
3
Identities Assigned Ownership
2
Identities Assigned Privileges
1
Loading...
Export | Clear

Identity | Owned Shares | Accessible Shares | Low Risk Shares | Medium Risk Shares | High Risk Shares | Critical Risk Shares
--- | --- | --- | --- | --- | --- | ---
BUILTIN\Administrators | 34 |  | 0 | 0 | 0 | 0

BUILTIN\Users

0

\\demo.local\C$
\\demo.local\backup
\\demo.local\inetpub
\\demo.local\sccm
\\demo.local\logs
\\demo.local\sql
\\demo.local\C
\\demo.local\apps
\\demo.local\wwwroot
\\2012SERVERSCCM.demo.local\C$
\\demo.local\ADMIN$
\\2012SERVERSCCM.demo.local\ADMIN$
\\2012SERVERSCCM.demo.local\CtxSTShare
\\2012SERVERSCCM.demo.local\files
\\2012SERVERSCCM.demo.local\REMINST
\\2012SERVERSCCM.demo.local\SophosUpdate

8

2

4

7

NT SERVICE\TrustedInstaller | 13 |  | 0 | 0 | 0 | 0

## Insecure ACEs

This section provides the ACE (access control entries) configured with excessive privileges found in the demo.local Active Directory domain.
Affected ACEs
47
Loading...
Export | Clear

Risk Level | Computer | Share Name | FileSystemRight | Identity | Share Owner | Creation Date | Last Modified | Files
--- | --- | --- | --- | --- | --- | --- | --- | ---
20 Critical | demo.local | C$ \\demo.local\C$ | AppendData/AddSubdirectory | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
22 Critical | demo.local | C$ \\demo.local\C$ | WriteData/AddFile | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
18 High | demo.local | C$ \\demo.local\C$ | Read | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
1 Low | demo.local | backup \\demo.local\backup | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | backup \\demo.local\backup | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | backup \\demo.local\backup | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
17 High | demo.local | inetpub \\demo.local\inetpub | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
19 High | demo.local | inetpub \\demo.local\inetpub | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
21 Critical | demo.local | inetpub \\demo.local\inetpub | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
1 Low | demo.local | sccm \\demo.local\sccm | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | sccm \\demo.local\sccm | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | sccm \\demo.local\sccm | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
1 Low | demo.local | logs \\demo.local\logs | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | logs \\demo.local\logs | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | logs \\demo.local\logs | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
1 Low | demo.local | sql \\demo.local\sql | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | sql \\demo.local\sql | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | sql \\demo.local\sql | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
20 Critical | demo.local | C \\demo.local\C | AppendData/AddSubdirectory | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
22 Critical | demo.local | C \\demo.local\C | WriteData/AddFile | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
18 High | demo.local | C \\demo.local\C | Read | BUILTIN\Users | NT SERVICE\TrustedInstaller | 7/26/2012 12:32:51 AM | 11/6/2024 5:26:55 PM | apps backup inetpub logs PerfLogs Program Files Program Files (x86) sccm sql Users Windows wwwroot
1 Low | demo.local | apps \\demo.local\apps | Read | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | apps \\demo.local\apps | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
3 Low | demo.local | apps \\demo.local\apps | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 7/26/2012 6:00:00 PM | 7/26/2012 6:00:00 PM |
17 High | demo.local | wwwroot \\demo.local\wwwroot | Read | BUILTIN\Users | BUILTIN\Administrators | 8/5/2020 6:00:00 PM | 8/5/2020 6:00:00 PM |
19 High | demo.local | wwwroot \\demo.local\wwwroot | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 8/5/2020 6:00:00 PM | 8/5/2020 6:00:00 PM |
21 Critical | demo.local | wwwroot \\demo.local\wwwroot | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 8/5/2020 6:00:00 PM | 8/5/2020 6:00:00 PM |

22 Critical

2012SERVERSCCM.demo.local

C$
\\2012SERVERSCCM.demo.local\C$

AppendData/AddSubdirectory

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:32:51 AM

11/6/2024 6:35:55 AM

CTXProfiles
CtxSTShare
files
inetpub
PerfLogs
Program Files
Program Files (x86)
REMINST
SophosUpdate
Users
Windows
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
sccm-key.txt

24 Critical

2012SERVERSCCM.demo.local

C$
\\2012SERVERSCCM.demo.local\C$

WriteData/AddFile

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:32:51 AM

11/6/2024 6:35:55 AM

CTXProfiles
CtxSTShare
files
inetpub
PerfLogs
Program Files
Program Files (x86)
REMINST
SophosUpdate
Users
Windows
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
sccm-key.txt

20 Critical

2012SERVERSCCM.demo.local

C$
\\2012SERVERSCCM.demo.local\C$

Read

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:32:51 AM

11/6/2024 6:35:55 AM

CTXProfiles
CtxSTShare
files
inetpub
PerfLogs
Program Files
Program Files (x86)
REMINST
SophosUpdate
Users
Windows
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
sccm-key.txt

20 Critical

demo.local

ADMIN$
\\demo.local\ADMIN$

GenericExecute,GenericRead

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:37:59 AM

5/8/2024 9:32:57 PM

ADAM
ADWS
AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
NTDS
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SYSVOL
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

20 Critical

demo.local

ADMIN$
\\demo.local\ADMIN$

Read

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:37:59 AM

5/8/2024 9:32:57 PM

ADAM
ADWS
AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
NTDS
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SYSVOL
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

20 Critical

2012SERVERSCCM.demo.local

ADMIN$
\\2012SERVERSCCM.demo.local\ADMIN$

GenericExecute,GenericRead

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:37:59 AM

9/24/2024 4:16:42 PM

AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
iis.log
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

20 Critical

2012SERVERSCCM.demo.local

ADMIN$
\\2012SERVERSCCM.demo.local\ADMIN$

Read

BUILTIN\Users

NT SERVICE\TrustedInstaller

7/26/2012 12:37:59 AM

9/24/2024 4:16:42 PM

AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
iis.log
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

3 Low | 2012SERVERSCCM.demo.local | CtxSTShare \\2012SERVERSCCM.demo.local\CtxSTShare | Read | BUILTIN\Users | BUILTIN\Administrators | 10/27/1991 11:01:00 PM | 10/27/1991 11:01:00 PM | testfile2.txt.txt
5 Medium | 2012SERVERSCCM.demo.local | CtxSTShare \\2012SERVERSCCM.demo.local\CtxSTShare | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 10/27/1991 11:01:00 PM | 10/27/1991 11:01:00 PM | testfile2.txt.txt
5 Medium | 2012SERVERSCCM.demo.local | CtxSTShare \\2012SERVERSCCM.demo.local\CtxSTShare | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 10/27/1991 11:01:00 PM | 10/27/1991 11:01:00 PM | testfile2.txt.txt

6 Medium

2012SERVERSCCM.demo.local

files
\\2012SERVERSCCM.demo.local\files

Read

BUILTIN\Users

BUILTIN\Administrators

9/25/2024 7:31:43 AM

10/7/2024 7:58:23 AM

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

6 Medium

2012SERVERSCCM.demo.local

files
\\2012SERVERSCCM.demo.local\files

Read

BUILTIN\Users

BUILTIN\Administrators

9/25/2024 7:31:43 AM

10/7/2024 7:58:23 AM

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

8 Medium

2012SERVERSCCM.demo.local

files
\\2012SERVERSCCM.demo.local\files

AppendData/AddSubdirectory

BUILTIN\Users

BUILTIN\Administrators

9/25/2024 7:31:43 AM

10/7/2024 7:58:23 AM

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

8 Medium

2012SERVERSCCM.demo.local

files
\\2012SERVERSCCM.demo.local\files

WriteData/AddFile

BUILTIN\Users

BUILTIN\Administrators

9/25/2024 7:31:43 AM

10/7/2024 7:58:23 AM

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

1 Low | 2012SERVERSCCM.demo.local | REMINST \\2012SERVERSCCM.demo.local\REMINST | Read | BUILTIN\Users | BUILTIN\Administrators | 4/8/2014 11:01:00 PM | 4/8/2014 11:01:00 PM |
3 Low | 2012SERVERSCCM.demo.local | REMINST \\2012SERVERSCCM.demo.local\REMINST | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 4/8/2014 11:01:00 PM | 4/8/2014 11:01:00 PM |
3 Low | 2012SERVERSCCM.demo.local | REMINST \\2012SERVERSCCM.demo.local\REMINST | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 4/8/2014 11:01:00 PM | 4/8/2014 11:01:00 PM |
2 Low | 2012SERVERSCCM.demo.local | SophosUpdate \\2012SERVERSCCM.demo.local\SophosUpdate | Read | BUILTIN\Users | BUILTIN\Administrators | 9/1/2001 11:01:00 PM | 9/1/2001 11:01:00 PM | testfile.txt.txt
4 Low | 2012SERVERSCCM.demo.local | SophosUpdate \\2012SERVERSCCM.demo.local\SophosUpdate | AppendData/AddSubdirectory | BUILTIN\Users | BUILTIN\Administrators | 9/1/2001 11:01:00 PM | 9/1/2001 11:01:00 PM | testfile.txt.txt
4 Low | 2012SERVERSCCM.demo.local | SophosUpdate \\2012SERVERSCCM.demo.local\SophosUpdate | WriteData/AddFile | BUILTIN\Users | BUILTIN\Administrators | 9/1/2001 11:01:00 PM | 9/1/2001 11:01:00 PM | testfile.txt.txt

## Computer Summary

This section provides a summary of the domain computers that were targeted, connectivity to them, and the number that are hosting potentially insecure SMB shares.

Description | Percent Chart | Percent | Computers | Details
--- | --- | --- | --- | ---
DISCOVERED |  | 100.00% | 13 | CSV | HTML
PING RESPONSE |  | 15.38% | 2 | CSV | HTML
PORT 445 OPEN |  | 15.38% | 2 | CSV | HTML
HOST SHARE |  | 15.38% | 2 | CSV | HTML
HOST NON-DEFAULT SHARE |  | 15.38% | 2 | CSV | HTML
HOST POTENTIALLY INSECURE SHARE |  | 15.38% | 2 | CSV | HTML
HOST READABLE SHARE |  | 15.38% | 2 | CSV | HTML
HOST WRITEABLE SHARE |  | 15.38% | 2 | CSV | HTML
HOST HIGH RISK SHARE |  | 15.38% | 2 | CSV | HTML

## Share Summary

Below is a summary of the SMB shares discovered on domain computers that may provide excessive privileges to standard domain users.

Description | Percent Chart | Percent | Shares | Details
--- | --- | --- | --- | ---
DISCOVERED |  | 100.00% | 21 | CSV | HTML
NON-DEFAULT |  | 90.48% | 19 | CSV | HTML
POTENTIALLY EXCESSIVE |  | 76.19% | 16 | CSV | HTML
READ ACCESS |  | 76.19% | 16 | CSV | HTML
WRITE ACCESS |  | 66.67% | 14 | CSV | HTML
HIGH RISK |  | 33.33% | 7 | CSV | HTML

Note: All Windows systems have a c$ and admin$ share configured by default. A a result, the number of visible shares should be (at a minimum) double the number of the computers found with port 445 open. In this case, 2 computers were found with port 445 open, so we would expect to discover approximetly 4 or more shares.

## Share ACL Entry Summary

Below is a summary of the SMB share ACL entries discovered on domain computers that may provide excessive privileges to standard domain users.

Description | Percent Chart | Percent | ACLs | Details
--- | --- | --- | --- | ---
DISCOVERED |  | 100.00% | 127 | CSV | HTML
NON-DEFAULT |  | 100.00% | 127 | CSV | HTML
POTENTIALLY EXCESSIVE |  | 37.01% | 47 | CSV | HTML
READ ACCESS |  | 14.96% | 19 | CSV | HTML
WRITE ACCESS |  | 11.02% | 14 | CSV | HTML
HIGH RISK |  | 14.96% | 19 | CSV | HTML

## Group ACL Summary

In the context of this report, excessive read and write share permissions have been defined as any network share ACL containing an explicit entry for the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups. All provide domain users access to the affected shares due to privilege inheritance. Below is a summary of the exposure associated with each of those groups.

Name | Excessive ACL Entries | Affected Computers | Affected Shares | Affected ACLs
--- | --- | --- | --- | ---
Everyone | Read Write High Risk : 0 : 0 : 0 | 0.00% (0 of 13) | 0.00% (0 of 21) | 0.00% (0 of 127)
BUILTIN\Users | Read Write High Risk : 19 : 14 : 19 | 37.01% (2 of 13) | 76.19% (16 of 21) | 15.38% (47 of 127)
Authenticated Users | Read Write High Risk : 0 : 0 : 0 | 0.00% (0 of 13) | 0.00% (0 of 21) | 0.00% (0 of 127)
Domain Users | Read Write High Risk : 0 : 0 : 0 | 0.00% (0 of 13) | 0.00% (0 of 21) | 0.00% (0 of 127)
Domain Computers | Read Write High Risk : 0 : 0 : 0 | 0.00% (0 of 13) | 0.00% (0 of 21) | 0.00% (0 of 127)

## Share Names

This section provide a summary and list of the affected shares grouped by name. 21 shares were discovered across 2 live computers in the demo.local Active Directory domain. 16 of those shares were found configured with excessive privileges across 2 computers.
Affected Shares Names
16
(14 unique names)
Loading...
Export | Clear
Quick Filters: Exploitable Write Read Interesting Empty Stale Default

Share
Count
Share Count
is the number of unique shares with
the same name.

Share
Name
Share Name
is the name of a
collection of share
with the same name.

Risk
Level
Risk Level
relfects the exposure of credentials and sensitive data.

Share
Similarity
Share Similarity
scores reflect how likely it is that the shares are related to each other.

Folder
Groups
Folder Groups
are groups of shares
that have the same
name and file listing.

Common
Files
Common Files
are file names that
exist in 10% or more
of the file groups.

Interesting
Files
Interesting Files
are filenames that
may be sensitive.

\\demo.local\C$
\\2012SERVERSCCM.demo.local\C$

Sample Description
Default share
Share Context Guess
The C$ may be associated with the Windows Admin Share. An administrative share for remote management. C$ is a default administrative share in Windows. C:\Windows\System32 is the expected local path.
LLM Application Guess
Windows Operating System, Microsoft System Center Configuration Manager
View in ShareGraph
Affected Assets

Computers: | 2 of 13 (15.38%)
Shares: | 2 of 21 (9.52%)
ACLs: | 6 of 127 (4.72%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 11/06/2024

Owners (1)
NT SERVICE\TrustedInstaller

Risk Summary

HE: | 100% (2)
Write: | 100% (2)
Read: | 100% (2)
Stale: | 100% (2)
Empty: | 0% (0)
Default: | Yes
Sensitive: | 0
Secrets: | 1

Final Score: : | 84%
File Name Coverage: | 100%
Folder Group Coverage: | 40%
Share Property Coverage: | 40%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 0
1 FG 60%/shares: | 0
1 FG 70%/shares: | 0
1 FG 80%/shares: | 0
1 FG 90%/shares: | 0
1 FG 100%/shares: | 0

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 0.50

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 0.50
All Descriptions Match: | 1

apps
backup
inetpub
logs
PerfLogs
Program Files
Program Files (x86)
sccm
sql
Users
Windows
wwwroot
CTXProfiles
CtxSTShare
files
inetpub
PerfLogs
Program Files
Program Files (x86)
REMINST
SophosUpdate
Users
Windows
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
sccm-key.txt

Users | 100% (2)
inetpub | 100% (2)
PerfLogs | 100% (2)
Program Files | 100% (2)
Program Files (x86) | 100% (2)
Windows | 100% (2)

system
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
backup
program files
program files (x86)

\\demo.local\ADMIN$
\\2012SERVERSCCM.demo.local\ADMIN$

Sample Description
Remote Admin
Share Context Guess
The ADMIN$ may be associated with the Windows Admin Share. An administrative share for remote management. ADMIN$ is a default administrative share in Windows C:\Windows\ is the expected local path.
LLM Application Guess
Microsoft Windows Operating System, Microsoft Windows
View in ShareGraph
Affected Assets

Computers: | 2 of 13 (15.38%)
Shares: | 2 of 21 (9.52%)
ACLs: | 4 of 127 (3.15%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 09/24/2024

Owners (1)
NT SERVICE\TrustedInstaller

Risk Summary

HE: | 100% (2)
Write: | 0% (0)
Read: | 100% (2)
Stale: | 100% (2)
Empty: | 0% (0)
Default: | Yes
Sensitive: | 0
Secrets: | 2

Final Score: : | 84%
File Name Coverage: | 100%
Folder Group Coverage: | 40%
Share Property Coverage: | 40%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 0
1 FG 60%/shares: | 0
1 FG 70%/shares: | 0
1 FG 80%/shares: | 0
1 FG 90%/shares: | 0
1 FG 100%/shares: | 0

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 0.50

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 0.50
All Descriptions Match: | 1

ADAM
ADWS
AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
NTDS
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SYSVOL
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe
AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
iis.log
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

schemas | 100% (2)
Temp | 100% (2)
Tasks | 100% (2)
TAPI | 100% (2)
SysWOW64 | 100% (2)
win.ini | 100% (2)
System32 | 100% (2)
ToastData | 100% (2)
System | 100% (2)
SoftwareDistribution | 100% (2)
Setup | 100% (2)
servicing | 100% (2)
ServiceProfiles | 100% (2)
security | 100% (2)
write.exe | 100% (2)
Speech | 100% (2)
tracing | 100% (2)
Vss | 100% (2)
Web | 100% (2)
splwow64.exe | 100% (2)
setuperr.log | 100% (2)
setupact.log | 100% (2)
ServerWeb.xml | 100% (2)
ServerStandard.xml | 100% (2)
regedit.exe | 100% (2)
PFRO.log | 100% (2)
mib.bin | 100% (2)
hh.exe | 100% (2)
HelpPane.exe | 100% (2)
explorer.exe | 100% (2)
DtcInstall.log | 100% (2)
bootstat.dat | 100% (2)
bfsvc.exe | 100% (2)
WinSxS | 100% (2)
SchCache | 100% (2)
Resources | 100% (2)
rescache | 100% (2)
RemotePackages | 100% (2)
drivers | 100% (2)
Downloaded Program Files | 100% (2)
DigitalLocker | 100% (2)
diagnostics | 100% (2)
DesktopTileResources | 100% (2)
debug | 100% (2)
Cursors | 100% (2)
CbsTemp | 100% (2)
Branding | 100% (2)
Boot | 100% (2)
AUInstallAgent | 100% (2)
assembly | 100% (2)
apppatch | 100% (2)
AppCompat | 100% (2)
winhlp32.exe | 100% (2)
en-US | 100% (2)
system.ini | 100% (2)
Fonts | 100% (2)
Help | 100% (2)
Registration | 100% (2)
Provisioning | 100% (2)
PolicyDefinitions | 100% (2)
PLA | 100% (2)
Panther | 100% (2)
Offline Web Pages | 100% (2)
WindowsUpdate.log | 100% (2)
ModemLogs | 100% (2)
Microsoft.NET | 100% (2)
media | 100% (2)
Logs | 100% (2)
LiveKernelReports | 100% (2)
L2Schemas | 100% (2)
Inf | 100% (2)
IME | 100% (2)
Globalization | 100% (2)
vmgcoinstall.log | 100% (2)

system
bfsvc.exe
explorer.exe
helppane.exe
hh.exe
regedit.exe
splwow64.exe
winhlp32.exe
write.exe
program files
downloaded program files

\\demo.local\backup

Share Context Guess
None
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\inetpub

Share Context Guess
The Inetpub may be associated with Internet Publishing. Directory for web server files (IIS) Standard directory for Internet Information Services (IIS). Referenced: https://docs.microsoft.com/en-us/iis/ C:\Inetpub\ is the expected local path.
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 100% (1)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\sccm

Share Context Guess
The SCCM may be associated with System Center Configuration Manager. Microsoft System Center Configuration Manager Directory used by Microsoft System Center Configuration Manager. Referenced: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/the-content-library C:\Program Files\Microsoft Configuration Manager\ is the expected local path.
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\logs

Share Context Guess
None
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\sql

Share Context Guess
None
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\C

Share Context Guess
None
LLM Application Guess
Windows
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 11/06/2024

Owners (1)
NT SERVICE\TrustedInstaller

Risk Summary

HE: | 100% (1)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 0% (0)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 100%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

apps
backup
inetpub
logs
PerfLogs
Program Files
Program Files (x86)
sccm
sql
Users
Windows
wwwroot

apps | 100% (1)
backup | 100% (1)
inetpub | 100% (1)
logs | 100% (1)
PerfLogs | 100% (1)
Program Files | 100% (1)
Program Files (x86) | 100% (1)
sccm | 100% (1)
sql | 100% (1)
Users | 100% (1)
Windows | 100% (1)
wwwroot | 100% (1)

backup
program files
program files (x86)

\\demo.local\apps

Share Context Guess
None
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 07/26/2012
Last Created: | 07/26/2012
Last Mod: | 07/26/2012

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\demo.local\wwwroot

Share Context Guess
The wwwroot may be associated with Web Server Root. Root directory for web server files Root directory for web server files. Referenced: https://docs.microsoft.com/ C:\inetpub\wwwroot\ is the expected local path.
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 08/05/2020
Last Created: | 08/05/2020
Last Mod: | 08/05/2020

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 100% (1)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\2012SERVERSCCM.demo.local\CtxSTShare

Share Context Guess
The CtxSTShare may be associated with Citrix Streaming Service Share. Used by Citrix Streaming Service for application delivery. The prefix 'Ctx' indicates Citrix-related shares. STShare might stand for Streaming Service Share. C:\ProgramData\Citrix\StreamingService is the expected local path.
LLM Application Guess
Citrix
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 10/27/1991
Last Created: | 10/27/1991
Last Mod: | 10/27/1991

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 0% (0)
Empty: | 0% (0)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 100%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

testfile2.txt.txt

testfile2.txt.txt | 100% (1)

\\2012SERVERSCCM.demo.local\files

Share Context Guess
None
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 4 of 127 (3.15%)

Timeline Context

First Created: | 09/25/2024
Last Created: | 09/25/2024
Last Mod: | 10/07/2024

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 0% (0)
Empty: | 0% (0)
Default: | No
Sensitive: | 0
Secrets: | 50

Final Score: : | 100%
File Name Coverage: | 100%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

things | 100% (1)
pureftpd.passwd | 100% (1)
putty.reg | 100% (1)
remmina.pref | 100% (1)
running-config.txt | 100% (1)
ScheduledTasks.xml | 100% (1)
server.xml | 100% (1)
Services.xml | 100% (1)
setting.ini | 100% (1)
shadow | 100% (1)
SiteManager.xml | 100% (1)
private.crt | 100% (1)
smb.conf | 100% (1)
standalone.xml | 100% (1)
startup-config.txt | 100% (1)
sysprep.inf | 100% (1)
tnsnames.ora | 100% (1)
tomcat-users.xml | 100% (1)
unattend-base64.xml | 100% (1)
unattend-cleartext.xml | 100% (1)
variables.dat | 100% (1)
vnc.ini | 100% (1)
web.config | 100% (1)
sssd.conf | 100% (1)
Printers.xml | 100% (1)
php.ini | 100% (1)
my.key | 100% (1)
.fetchmailrc | 100% (1)
.git-credentials | 100% (1)
.htpasswd | 100% (1)
.netrc | 100% (1)
.pgpass | 100% (1)
.remmina | 100% (1)
app.config | 100% (1)
bootstrap.ini | 100% (1)
config.xml | 100% (1)
context.xml | 100% (1)
DataSources.xml | 100% (1)
dbvis.xml | 100% (1)
dbxdrivers.ini | 100% (1)
Drives.xml | 100% (1)
example.dtsx | 100% (1)
example.rdp | 100% (1)
Groups.xml | 100% (1)
grub.cfg | 100% (1)
grub.conf | 100% (1)
jboss-cli.xml | 100% (1)
krb5.conf | 100% (1)
machine.config | 100% (1)
my.cnf | 100% (1)
WinSCP.ini | 100% (1)
wp-config.php | 100% (1)

bootstrap.ini
context.xml
dbxdrivers.ini
pureftpd.passwd
config.xml
jboss-cli.xml
machine.config
startup-config.txt
running-config.txt
my.cnf
my.key
php.ini
putty.reg
server.xml
shadow
standalone.xml
tnsnames.ora
tomcat-users.xml
sitemanager.xml
variables.dat
setting.ini
winscp.ini
wp-config.php
app.config
web.config
example.dtsx
example.rdp
vnc.ini
scheduledtasks.xml
groups.xml
drives.xml
services.xml
printers.xml
unattend-base64.xml
unattend-cleartext.xml
sysprep.inf
private.crt
sssd.conf
smb.conf
krb5.conf
.htpasswd
.pgpass
grub.cfg
grub.conf
.fetchmailrc
.git-credentials
.netrc
dbvis.xml
remmina.pref
.remmina

\\2012SERVERSCCM.demo.local\REMINST

Share Context Guess
The REMINST may be associated with Remote Installation Services (RIS) / Windows Deployment Services (WDS). Microsoft service for remote installation and deployment Used by Microsoft's Remote Installation Services or Windows Deployment Services. Default path is C:\RemoteInstall. C:\RemoteInstall\ is the expected local path.
LLM Application Guess
Unknown
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 04/08/2014
Last Created: | 04/08/2014
Last Mod: | 04/08/2014

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 100% (1)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 0%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 0
FG Coverage 20%: | 0
FG Coverage 30%: | 0
FG Coverage 40%: | 0
FG Coverage 51%: | 0
FG Coverage 60%: | 0
FG Coverage 70%: | 0
FG Coverage 80%: | 0
FG Coverage 90%: | 0
FG Coverage 100%: | 0

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

\\2012SERVERSCCM.demo.local\SophosUpdate

Share Context Guess
The SophosUpdate may be associated with Sophos Update. Directory for storing Sophos antivirus updates Used by Sophos antivirus for storing update files. Referenced: https://www.sophos.com/ C:\SophosUpdate\ is the expected local path.
LLM Application Guess
Sophos
View in ShareGraph
Affected Assets

Computers: | 1 of 13 (7.69%)
Shares: | 1 of 21 (4.76%)
ACLs: | 3 of 127 (2.36%)

Timeline Context

First Created: | 09/01/2001
Last Created: | 09/01/2001
Last Mod: | 09/01/2001

Owners (1)
BUILTIN\Administrators

Risk Summary

HE: | 0% (0)
Write: | 100% (1)
Read: | 100% (1)
Stale: | 100% (1)
Empty: | 0% (0)
Default: | No
Sensitive: | 0
Secrets: | 0

Final Score: : | 100%
File Name Coverage: | 100%
Folder Group Coverage: | 100%
Share Property Coverage: | 100%

---
File Name Metrics

FG Coverage 10%: | 1
FG Coverage 20%: | 1
FG Coverage 30%: | 1
FG Coverage 40%: | 1
FG Coverage 51%: | 1
FG Coverage 60%: | 1
FG Coverage 70%: | 1
FG Coverage 80%: | 1
FG Coverage 90%: | 1
FG Coverage 100%: | 1

Folder Group Metrics

1 FG 10%/shares: | 1
1 FG 20%/shares: | 1
1 FG 30%/shares: | 1
1 FG 40%/shares: | 1
1 FG 51%/shares: | 1
1 FG 60%/shares: | 1
1 FG 70%/shares: | 1
1 FG 80%/shares: | 1
1 FG 90%/shares: | 1
1 FG 100%/shares: | 1

Share Property Metrics

Same Share Name: | 1
folder Group/Owner Ratio Average: | 1.00
Creation Date/Share Ratio: | 1.00
Last Modification Date/Share Ratio: | 1.00

Experimental Metrics

Share Owner Ratio: | 1.00
File Group/Name Ratio: | 1.00
All Descriptions Match: | 0

testfile.txt.txt

testfile.txt.txt | 100% (1)

## Networks

This section provides an overview of the affected networks. 1 networks/subnets were found associated with computers that host shares that are configured with excessive privileges.
Affected Networks
1
Loading...
Export | Clear

Subnet | Desc | Created | Site | ACEs | ReadACEs | WriteACEs | ExploitableACEs | Shares | Computers
--- | --- | --- | --- | --- | --- | --- | --- | --- | ---
192.168.40.0 |  |  |  | 47 | 19 | 14 | 19 | 16 | 2

## Share Owners

This section lists the most common share owners.

Share Count | Owner | Affected Computers | Affected Shares | Affected ACLs
--- | --- | --- | --- | ---
11 | BUILTIN\Administrators | 15.38% (2 of 13) | 52.38% (11 of 21) | 26.77% (34 of 127)
5 | NT SERVICE\TrustedInstaller | 15.38% (2 of 13) | 23.81% (5 of 21) | 10.24% (13 of 127)

## Folder Groups

Folder groups are SMB shares that contain the exact same file listing. Each folder group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation. Note: Application fingerprints were generated using an experimental version of the LLM-based application fingerprinting function. As a result, some application classifications may not be accurate.
Affected Folder Groups
8
Loading...
Export | Clear

Unique Share Names | Share Count | File Count | Risk Level | Folder Group | Related App
--- | --- | --- | --- | --- | ---
backup inetpub sccm logs sql apps wwwroot REMINST | \\demo.local\backup \\demo.local\inetpub \\demo.local\sccm \\demo.local\logs \\demo.local\sql \\demo.local\apps \\demo.local\wwwroot \\2012SERVERSCCM.demo.local\REMINST |  | 21 Critical | d41d8cd98f00b204e9800998ecf8427e |

C$
C

\\demo.local\C$
\\demo.local\C

apps
backup
inetpub
logs
PerfLogs
Program Files
Program Files (x86)
sccm
sql
Users
Windows
wwwroot

22 Critical

003fe65715d4b71b68e7e42d2cbfd11f

The share name "C$" is commonly associated with the Windows operating system's default administrative share. The presence of directories such as "Program Files", "Windows", "Users", and "inetpub" strongly indicates that this is a Windows operating system. More information can be found at https://www.microsoft.com/en-us/windows

files

\\2012SERVERSCCM.demo.local\files

things
.fetchmailrc
.git-credentials
.htpasswd
.netrc
.pgpass
.remmina
app.config
bootstrap.ini
config.xml
context.xml
DataSources.xml
dbvis.xml
dbxdrivers.ini
Drives.xml
example.dtsx
example.rdp
Groups.xml
grub.cfg
grub.conf
jboss-cli.xml
krb5.conf
machine.config
my.cnf
my.key
php.ini
Printers.xml
private.crt
pureftpd.passwd
putty.reg
remmina.pref
running-config.txt
ScheduledTasks.xml
server.xml
Services.xml
setting.ini
shadow
SiteManager.xml
smb.conf
sssd.conf
standalone.xml
startup-config.txt
sysprep.inf
tnsnames.ora
tomcat-users.xml
unattend-base64.xml
unattend-cleartext.xml
variables.dat
vnc.ini
web.config
WinSCP.ini
wp-config.php

8 Medium

608fe6cb11c8dd935745fdfbce83c5be

C$

\\2012SERVERSCCM.demo.local\C$

CTXProfiles
CtxSTShare
files
inetpub
PerfLogs
Program Files
Program Files (x86)
REMINST
SophosUpdate
Users
Windows
en_sql_server_2014_developer_edition_x64_dvd_3940406.iso
mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso
sccm-key.txt

24 Critical

f910ff7451dc52f16511bc1858288a7b

The share name "C$" is commonly associated with system drives on Windows operating systems. The presence of files like "mu_system_center_2012_r2_configuration_manager_x86_and_x64_dvd_2926949.iso" and "sccm-key.txt" strongly indicates the use of Microsoft System Center Configuration Manager, which aligns with the share name and the file context. For more information, visit https://www.microsoft.com/en-us/download/details.aspx?id=34607.

CtxSTShare | \\2012SERVERSCCM.demo.local\CtxSTShare | testfile2.txt.txt | 5 Medium | 30b6dc96e3419e712c67cadaaa881ac6 | The share name 'CtxSTShare' suggests a relation to Citrix, a known application. The file names alone are not strongly indicative, but the share name provides a high confidence match. For more information, visit: https://www.citrix.com/

SophosUpdate

\\2012SERVERSCCM.demo.local\SophosUpdate

testfile.txt.txt

4 Low

47b0b36ca438303cfe7082a5ac09d719

The share name 'SophosUpdate' directly indicates a connection to Sophos, a well-known cybersecurity company. Although the file name 'testfile.txt.txt' is generic, the strong association with the share name provides a high confidence in identifying the application as Sophos. For more information, visit https://www.sophos.com.

ADMIN$

\\demo.local\ADMIN$

ADAM
ADWS
AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
NTDS
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SYSVOL
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

20 Critical

16c18b433687bed2b033f40cf56229e5

The share name "ADMIN$" is a default administrative share in Microsoft Windows Operating System. The file names such as "explorer.exe", "regedit.exe", "setupact.log", "setuperr.log", and "ServerStandard.xml" are commonly associated with the Windows OS. For more information, visit https://www.microsoft.com/en-us/windows

ADMIN$

\\2012SERVERSCCM.demo.local\ADMIN$

AppCompat
apppatch
assembly
AUInstallAgent
Boot
Branding
CbsTemp
Cursors
debug
DesktopTileResources
diagnostics
DigitalLocker
Downloaded Program Files
drivers
en-US
Fonts
Globalization
Help
IME
Inf
L2Schemas
LiveKernelReports
Logs
media
Microsoft.NET
ModemLogs
Offline Web Pages
Panther
PLA
PolicyDefinitions
Provisioning
Registration
RemotePackages
rescache
Resources
SchCache
schemas
security
ServiceProfiles
servicing
Setup
SoftwareDistribution
Speech
System
System32
SysWOW64
TAPI
Tasks
Temp
ToastData
tracing
Vss
Web
WinSxS
bfsvc.exe
bootstat.dat
DtcInstall.log
explorer.exe
HelpPane.exe
hh.exe
iis.log
mib.bin
PFRO.log
regedit.exe
ServerStandard.xml
ServerWeb.xml
setupact.log
setuperr.log
splwow64.exe
system.ini
vmgcoinstall.log
win.ini
WindowsUpdate.log
winhlp32.exe
write.exe

20 Critical

526419fbc5b1d0c1274573fa97986a32

The share name "ADMIN$" is typically associated with administrative shares in Microsoft Windows. File names like "System32", "drivers", "Microsoft.NET", "Boot", and "Fonts" are indicative of a Windows operating system. For more information, visit: https://www.microsoft.com/en-us/windows

## Extracted Secrets

This section includes a list of the credentials that were recovered during data collection. 143 credentials were recovered from 50 of the discovered 53 secrets files.
Extracted Secrets Found
143
Loading...
Export | Clear

ComputerName | ShareName | FileName | FilePath | Username | Password | PasswordEnc | KeyfilePath | Details
--- | --- | --- | --- | --- | --- | --- | --- | ---
2012SERVERSCCM.demo.local | files | bootstrap.ini | \\2012SERVERSCCM.demo.local\files\bootstrap.ini | adminUser | P@ssw0rd123 | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | bootstrap.ini | \\2012SERVERSCCM.demo.local\files\bootstrap.ini | NA | public | NA | NA | Section: NA Object Name: Public Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | bootstrap.ini | \\2012SERVERSCCM.demo.local\files\bootstrap.ini | NA | mysecret | NA | NA | Section: NA Object Name: Private Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | bootstrap.ini | \\2012SERVERSCCM.demo.local\files\bootstrap.ini | NA | mysecret | NA | NA | Section: NA Object Name: Secret Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | bootstrap.ini | \\2012SERVERSCCM.demo.local\files\bootstrap.ini | NA | mykey | NA | NA | Section: NA Object Name: Key Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | context.xml | \\2012SERVERSCCM.demo.local\files\context.xml | dbuser | dbpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | user | password | NA | NA | Section: DB2 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | sysdba | masterkey | NA | NA | Section: Interbase Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | user | password | NA | NA | Section: Oracle Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | user | password | NA | NA | Section: Informix Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | user | password | NA | NA | Section: MSSQL Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB Interbase6 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB Interbase65 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB Interbase7 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB Interbase71 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB FireBird102 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB FireBird103 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB FireBird15 Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbxdrivers.ini | \\2012SERVERSCCM.demo.local\files\dbxdrivers.ini | SYSDBA | masterkey | NA | NA | Section: UIB Yaffil Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | pureftpd.passwd | \\2012SERVERSCCM.demo.local\files\pureftpd.passwd | username | NA | $1$X9p2ER8W$M7P5CxX5CHPxuAiB5BBJq/ | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | pureftpd.passwd | \\2012SERVERSCCM.demo.local\files\pureftpd.passwd | user2 | NA | $1$XYz3ERzW$G9P7CxF6CPxxuAiB6BBJq/ | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | config.xml | \\2012SERVERSCCM.demo.local\files\config.xml | John Doe | #jbcrypt:$2a$10$D6wVozrLhk.TIq.jBBKZluIh/EqzpjCUJFT/mWUnyAO4EYmxk5.aK | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | jboss-cli.xml | \\2012SERVERSCCM.demo.local\files\jboss-cli.xml | admin | password | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myAppUser | myAppPassword | NA |  | Section: AppSettings Object Name: Application Target URL: Target Server: Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myClientId | myClientSecret | NA |  | Section: AppSettings Object Name: OAuth Target URL: https://oauth.example.com/token Target Server: Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | serviceUser | servicePassword | NA |  | Section: AppSettings Object Name: WebClient Target URL: https://service.example.com/api Target Server: Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | apiUser | apiPassword | NA |  | Section: AppSettings Object Name: API Target URL: https://api.example.com/endpoint Target Server: Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | customUser | customPassword | NA |  | Section: ServiceCredentials Object Name: CustomService Target URL: https://customservice.example.com Target Server: Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA |  | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA |  | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerEncryptedConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA |  | Section: ConnectionStrings (Npgsql) Object Name: PostgreSqlConnection Target URL: Host=localhost;Port=5432 Target Server: localhost Target Port: 5432 Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | oracleUser | oraclePass | NA |  | Section: ConnectionStrings (System.Data.OracleClient) Object Name: OracleConnection Target URL: Server=MyOracleDB Target Server: MyOracleDB Target Port: Database: Domain:

2012SERVERSCCM.demo.local

files

machine.config

\\2012SERVERSCCM.demo.local\files\machine.config

oracleUser

oraclePass

NA

Section: ConnectionStrings (Oracle.ManagedDataAccess.Client)
Object Name: OracleTNSConnection
Target URL: Server=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myHost)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myService)))
Target Server: (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myHost)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myService)))
Target Port:
Database:
Domain:

2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | admin | myPass | NA |  | Section: ConnectionStrings (System.Data.OleDb) Object Name: AccessConnection Target URL: Server=C:\myAccessFile.accdb Target Server: C:\myAccessFile.accdb Target Port: Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA |  | Section: ConnectionStrings (System.Data.SqlClient) Object Name: AzureSqlConnection Target URL: Server=tcp:myserver.database.windows.net Target Server: tcp:myserver.database.windows.net Target Port: 1433 Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | smtpUser | smtpPassword | NA |  | Section: SMTP Object Name: SMTP Configuration Target URL: smtp://smtp.example.com:587 Target Server: smtp.example.com Target Port: 587 Database: Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA | NA | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: localhost Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA | NA | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerEncryptedConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: localhost Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA | NA | Section: ConnectionStrings (Npgsql) Object Name: PostgreSqlConnection Target URL: Host=localhost;Port=5432 Target Server: localhost Target Port: 5432 Database: myDB Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | oracleUser | oraclePass | NA | NA | Section: ConnectionStrings (System.Data.OracleClient) Object Name: OracleConnection Target URL: Server=MyOracleDB Target Server: MyOracleDB Target Port: Database: MyOracleDB Domain:

2012SERVERSCCM.demo.local

files

machine.config

\\2012SERVERSCCM.demo.local\files\machine.config

oracleUser

oraclePass

NA

NA

Section: ConnectionStrings (Oracle.ManagedDataAccess.Client)
Object Name: OracleTNSConnection
Target URL: Server=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myHost)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myService)))
Target Server: (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myHost)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myService)))
Target Port:
Database: (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=myHost)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=myService)))
Domain:

2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | admin | myPass | NA | NA | Section: ConnectionStrings (System.Data.OleDb) Object Name: AccessConnection Target URL: Server=C:\myAccessFile.accdb Target Server: C:\myAccessFile.accdb Target Port: Database: C:\myAccessFile.accdb Domain:
2012SERVERSCCM.demo.local | files | machine.config | \\2012SERVERSCCM.demo.local\files\machine.config | myUser | myPass | NA | NA | Section: ConnectionStrings (System.Data.SqlClient) Object Name: AzureSqlConnection Target URL: Server=tcp:myserver.database.windows.net Target Server: tcp:myserver.database.windows.net Target Port: 1433 Database: myDB Domain:
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | NA | $1$DkGh$XSdDk6LdoqM0eO67V0lJ71 | NA | Section: NA Object Name: EnableSecret (MD5 Encrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | mycleartextpassword | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | cleartext123 | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | moretype7pw | 12140A05171F15142F7C343F | NA | Section: NA Object Name: Password (Type 7 Decrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | secureadmin | NA | $1$lpb1$kGc1R/tGbT6aYZEXw5lqa0 | NA | Section: NA Object Name: Username Password (MD5 Encrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | public | NA | NA | Section: NA Object Name: SNMP Community String (RO) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | private | NA | NA | Section: NA Object Name: SNMP Community String (RW) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | consolepassword123 | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | ciscotype7clear | 02050D4808091B385C4B5E1A09121319 | NA | Section: NA Object Name: Password (Type 7 Decrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | startup-config.txt | \\2012SERVERSCCM.demo.local\files\startup-config.txt | NA | cleartextkeywifipassword | NA | NA | Section: NA Object Name: Wi-Fi WPA Pre-Shared Key (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | NA | $1$DkGh$XSdDk6LdoqM0eO67V0lJ71 | NA | Section: NA Object Name: EnableSecret (MD5 Encrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | mycleartextpassword | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | cleartext123 | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | moretype7pw | 12140A05171F15142F7C343F | NA | Section: NA Object Name: Password (Type 7 Decrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | secureadmin | NA | $1$lpb1$kGc1R/tGbT6aYZEXw5lqa0 | NA | Section: NA Object Name: Username Password (MD5 Encrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | public | NA | NA | Section: NA Object Name: SNMP Community String (RO) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | private | NA | NA | Section: NA Object Name: SNMP Community String (RW) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | consolepassword123 | NA | NA | Section: NA Object Name: Password (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | ciscotype7clear | 02050D4808091B385C4B5E1A09121319 | NA | Section: NA Object Name: Password (Type 7 Decrypted) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | running-config.txt | \\2012SERVERSCCM.demo.local\files\running-config.txt | NA | cleartextkeywifipassword | NA | NA | Section: NA Object Name: Wi-Fi WPA Pre-Shared Key (Cleartext) Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | my.cnf | \\2012SERVERSCCM.demo.local\files\my.cnf | yourusername | yourpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | my.key | \\2012SERVERSCCM.demo.local\files\my.key | NA | NA | NA | C:\temp\SmbShareHunt-11072024080834\Results\Secrets\2012SERVERSCCM.demo.local\files\my.key | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | php.ini | \\2012SERVERSCCM.demo.local\files\php.ini | dbuser | P@ssw0rd123 | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | putty.reg | \\2012SERVERSCCM.demo.local\files\putty.reg |  | NA | NA |  | Section: Default%20Settings Object Name: NA Target URL: NA Target Server: Target Port: 22 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | putty.reg | \\2012SERVERSCCM.demo.local\files\putty.reg | myusername | NA | NA | C:\\Users\\YourUsername\\.ssh\\id_rsa.ppk | Section: My%20SSH%20Session Object Name: NA Target URL: NA Target Server: 192.168.1.100 Target Port: 22 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | adminuser | adminpwd | NA | NA | Section: basicRegistry Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | reader | readerpwd | NA | NA | Section: basicRegistry Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | user | userpwd | NA | NA | Section: basicRegistry Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | dbuser | dbpass | NA | NA | Section: variable Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | dbuser | {xor}Oz0vPiws | NA | NA | Section: containerAuthData Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml |  |  | NA | NA | Section: containerAuthData Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | dbuser | dbpass | NA | NA | Section: authData Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | server.xml | \\2012SERVERSCCM.demo.local\files\server.xml | dbuser | wrong_password | NA | NA | Section: authData Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | shadow | \\2012SERVERSCCM.demo.local\files\shadow | root | NA | $6$examplehash$E5iNRLtC5/j/kCkRhYlOro.Y9PzE0Gv8jlsfLZUNwlEm7HMBZSO9.mUvefOrKT6BjKSO4obQ.EtCZKhQgmgwV0 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | shadow | \\2012SERVERSCCM.demo.local\files\shadow | user1 | NA | $6$examplehash$OwhxlyS5hoxfFE4tmtyOR8Hw1k8PLqokP9FYxYP8QMG3wO0u.0Xvd4g/0Udr6BQZilJk4k7XwlxJ6p0RJ2IL5/ | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | shadow | \\2012SERVERSCCM.demo.local\files\shadow | nobody | NA | * | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | shadow | \\2012SERVERSCCM.demo.local\files\shadow | daemon | NA | * | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | standalone.xml | \\2012SERVERSCCM.demo.local\files\standalone.xml | ${VAULT::vault::mydbuser} | ${VAULT::vault::mydbpassword} | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: localhost Target Port: 3306 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | standalone.xml | \\2012SERVERSCCM.demo.local\files\standalone.xml | Keystore | password | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | tnsnames.ora | \\2012SERVERSCCM.demo.local\files\tnsnames.ora | myusername | mypassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: MYDB Domain: NA
2012SERVERSCCM.demo.local | files | tnsnames.ora | \\2012SERVERSCCM.demo.local\files\tnsnames.ora | anotheruser | anotherpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: MYDB_ALIAS Domain: NA
2012SERVERSCCM.demo.local | files | tomcat-users.xml | \\2012SERVERSCCM.demo.local\files\tomcat-users.xml | admin | admin | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | sitemanager.xml | \\2012SERVERSCCM.demo.local\files\sitemanager.xml | username | HelloPassword | SGVsbG9QYXNzd29yZA== | NA | Section: NA Object Name: NA Target URL: NA Target Server: ftp.example.com Target Port: 21 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | sitemanager.xml | \\2012SERVERSCCM.demo.local\files\sitemanager.xml | sftpuser | HelloPassword | SGVsbG9QYXNzd29yZA== | NA | Section: NA Object Name: NA Target URL: NA Target Server: sftp.example.com Target Port: 22 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | setting.ini | \\2012SERVERSCCM.demo.local\files\setting.ini | dbuser | dbpass | NA | NA | Section: DatabaseSettings Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | setting.ini | \\2012SERVERSCCM.demo.local\files\setting.ini | myuser | mypass | NA | NA | Section: CustomSettings Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | winscp.ini | \\2012SERVERSCCM.demo.local\files\winscp.ini | myuser | 0V5aNH+/kT8= ; Encrypted password | NA |  | Section: NA Object Name: NA Target URL: NA Target Server: ftp.example.com Target Port: 21 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | wp-config.php | \\2012SERVERSCCM.demo.local\files\wp-config.php | your_database_username | your_secure_password_here | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | app.config | \\2012SERVERSCCM.demo.local\files\app.config | myUser | myPass | NA | NA | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: localhost Domain:
2012SERVERSCCM.demo.local | files | app.config | \\2012SERVERSCCM.demo.local\files\app.config | myUser | myPass | NA | NA | Section: ConnectionStrings (Npgsql) Object Name: PostgreSqlConnection Target URL: Host=localhost;Port=5432 Target Server: localhost Target Port: 5432 Database: myDB Domain:
2012SERVERSCCM.demo.local | files | app.config | \\2012SERVERSCCM.demo.local\files\app.config | oracleUser | oraclePass | NA | NA | Section: ConnectionStrings (Oracle.ManagedDataAccess.Client) Object Name: OracleConnection Target URL: Server=MyOracleDB Target Server: MyOracleDB Target Port: Database: MyOracleDB Domain:
2012SERVERSCCM.demo.local | files | web.config | \\2012SERVERSCCM.demo.local\files\web.config | myUser | myPass | NA | NA | Section: ConnectionStrings (System.Data.SqlClient) Object Name: SqlServerConnection Target URL: Server=localhost Target Server: localhost Target Port: Database: localhost Domain:
2012SERVERSCCM.demo.local | files | web.config | \\2012SERVERSCCM.demo.local\files\web.config | myUser | myPass | NA | NA | Section: ConnectionStrings (Npgsql) Object Name: PostgreSqlConnection Target URL: Host=localhost;Port=5432 Target Server: localhost Target Port: 5432 Database: myDB Domain:
2012SERVERSCCM.demo.local | files | web.config | \\2012SERVERSCCM.demo.local\files\web.config | oracleUser | oraclePass | NA | NA | Section: ConnectionStrings (Oracle.ManagedDataAccess.Client) Object Name: OracleConnection Target URL: Server=MyOracleDB Target Server: MyOracleDB Target Port: Database: MyOracleDB Domain:
2012SERVERSCCM.demo.local | files | example.dtsx | \\2012SERVERSCCM.demo.local\files\example.dtsx | dbuser1 | dbpassword1 | NA | NA | Section: Database Object Name: NA Target URL: NA Target Server: dbserver1 Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | example.dtsx | \\2012SERVERSCCM.demo.local\files\example.dtsx | dbuser2 | dbpassword2 | NA | NA | Section: Database Object Name: NA Target URL: NA Target Server: dbserver2 Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | example.dtsx | \\2012SERVERSCCM.demo.local\files\example.dtsx | ftpuser | ftppassword | NA | NA | Section: FTP Object Name: NA Target URL: NA Target Server: ftpserver.com Target Port: 21 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | example.dtsx | \\2012SERVERSCCM.demo.local\files\example.dtsx | smtpuser | smtppassword | NA | NA | Section: SMTP Object Name: NA Target URL: NA Target Server: smtp.mailserver.com Target Port: 25 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | example.rdp | \\2012SERVERSCCM.demo.local\files\example.rdp | YourUsername | Unable to decrypt; must run on target system | encrypted_password_value | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | vnc.ini | \\2012SERVERSCCM.demo.local\files\vnc.ini | NA | hellothe | 01d47b4186dfa5a3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | scheduledtasks.xml | \\2012SERVERSCCM.demo.local\files\scheduledtasks.xml |  | MyAwesomePassword! | 5gn5fUqMaeGJkLEPgl3iH9UfLATVxRAHE8GvAvekwnicLYf2Pynj7ifihvajBRA3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain:
2012SERVERSCCM.demo.local | files | groups.xml | \\2012SERVERSCCM.demo.local\files\groups.xml | example.com\IT_Dept | MyAwesomePassword! | 5gn5fUqMaeGJkLEPgl3iH9UfLATVxRAHE8GvAvekwnicLYf2Pynj7ifihvajBRA3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain:
2012SERVERSCCM.demo.local | files | drives.xml | \\2012SERVERSCCM.demo.local\files\drives.xml | test | MyAwesomePassword! | 5gn5fUqMaeGJkLEPgl3iH9UfLATVxRAHE8GvAvekwnicLYf2Pynj7ifihvajBRA3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain:
2012SERVERSCCM.demo.local | files | services.xml | \\2012SERVERSCCM.demo.local\files\services.xml | LocalSystem | MyAwesomePassword! | 5gn5fUqMaeGJkLEPgl3iH9UfLATVxRAHE8GvAvekwnicLYf2Pynj7ifihvajBRA3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain:
2012SERVERSCCM.demo.local | files | printers.xml | \\2012SERVERSCCM.demo.local\files\printers.xml |  | MyAwesomePassword! | 5gn5fUqMaeGJkLEPgl3iH9UfLATVxRAHE8GvAvekwnicLYf2Pynj7ifihvajBRA3 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain:
2012SERVERSCCM.demo.local | files | unattend-base64.xml | \\2012SERVERSCCM.demo.local\files\unattend-base64.xml | LocalAdmin | P@ssword123! | NA | NA | Section: AutoLogon Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | unattend-base64.xml | \\2012SERVERSCCM.demo.local\files\unattend-base64.xml | LocalAdmin | P@ssword123! | NA | NA | Section: LocalAccount Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | unattend-cleartext.xml | \\2012SERVERSCCM.demo.local\files\unattend-cleartext.xml | LocalAdmin | P@ssword | NA | NA | Section: AutoLogon Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | unattend-cleartext.xml | \\2012SERVERSCCM.demo.local\files\unattend-cleartext.xml | LocalAdmin | P@ssword | NA | NA | Section: LocalAccount Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | sysprep.inf | \\2012SERVERSCCM.demo.local\files\sysprep.inf | YourDomainAdmin | YourDomainAdminPassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: YourDomain
2012SERVERSCCM.demo.local | files | sysprep.inf | \\2012SERVERSCCM.demo.local\files\sysprep.inf | Administrator | YourAdminPassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: localhost
2012SERVERSCCM.demo.local | files | private.crt | \\2012SERVERSCCM.demo.local\files\private.crt | NA | NA | NA | C:\temp\SmbShareHunt-11072024080834\Results\Secrets\2012SERVERSCCM.demo.local\files\private.crt | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | sssd.conf | \\2012SERVERSCCM.demo.local\files\sssd.conf | cn=admin,cn=users,dc=example,dc=com | P@ssw0rd123 | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: ad.example.com Target Port: NA Database: NA Domain: example.com
2012SERVERSCCM.demo.local | files | smb.conf | \\2012SERVERSCCM.demo.local\files\smb.conf | ad-admin | P@ssw0rd123 | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | krb5.conf | \\2012SERVERSCCM.demo.local\files\krb5.conf | admin@EXAMPLE.COM | P@ssw0rd123 | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: ad.example.com Target Port: NA Database: NA Domain: EXAMPLE.COM
2012SERVERSCCM.demo.local | files | .htpasswd | \\2012SERVERSCCM.demo.local\files\.htpasswd | user1 | NA | $apr1$5lRQ1y3v$pmOQf9/fNVE5dTtQDBl9D1 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .htpasswd | \\2012SERVERSCCM.demo.local\files\.htpasswd | user2 | NA | $apr1$Jd9UE91p$J/H8G9HSvj5l8LKQ2qfd3. | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .htpasswd | \\2012SERVERSCCM.demo.local\files\.htpasswd | admin | NA | $apr1$GZJoqjNF$wl8IjDhZC84z5Bb4wHOv50 | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .pgpass | \\2012SERVERSCCM.demo.local\files\.pgpass | myuser | mypassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: localhost Target Port: 5432 Database: mydatabase Domain: NA
2012SERVERSCCM.demo.local | files | .pgpass | \\2012SERVERSCCM.demo.local\files\.pgpass | anotheruser | anotherpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: remote.server.com Target Port: 5432 Database: anotherdb Domain: NA
2012SERVERSCCM.demo.local | files | .pgpass | \\2012SERVERSCCM.demo.local\files\.pgpass | defaultuser | defaultpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: localhost Target Port: * Database: * Domain: NA
2012SERVERSCCM.demo.local | files | .pgpass | \\2012SERVERSCCM.demo.local\files\.pgpass | * | supersecretpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: localhost Target Port: * Database: * Domain: NA
2012SERVERSCCM.demo.local | files | grub.cfg | \\2012SERVERSCCM.demo.local\files\grub.cfg | admin | myplaintextpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | grub.conf | \\2012SERVERSCCM.demo.local\files\grub.conf | admin | myplaintextpassword | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .fetchmailrc | \\2012SERVERSCCM.demo.local\files\.fetchmailrc | user1@example.com | password1 | NA | NA | Section: IMAP Object Name: NA Target URL: NA Target Server: mail.example.com Target Port: 993 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .fetchmailrc | \\2012SERVERSCCM.demo.local\files\.fetchmailrc | user2@anotherexample.com | password2 | NA | NA | Section: POP3 Object Name: NA Target URL: NA Target Server: mail.anotherexample.com Target Port: 995 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .fetchmailrc | \\2012SERVERSCCM.demo.local\files\.fetchmailrc | forwarduser@forwardexample.com | forwardpassword | NA | NA | Section: IMAP Object Name: NA Target URL: NA Target Server: mail.forwardexample.com Target Port: 993 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .fetchmailrc | \\2012SERVERSCCM.demo.local\files\.fetchmailrc | plainuser@plainexample.com | plainpassword | NA | NA | Section: POP3 Object Name: NA Target URL: NA Target Server: plainexample.com Target Port: 110 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .git-credentials | \\2012SERVERSCCM.demo.local\files\.git-credentials | username1 | ghp_token1example | NA | NA | Section: NA Object Name: NA Target URL: github.com Target Server: github.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .git-credentials | \\2012SERVERSCCM.demo.local\files\.git-credentials | username2 | ghp_token2example | NA | NA | Section: NA Object Name: NA Target URL: bitbucket.org Target Server: bitbucket.org Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .git-credentials | \\2012SERVERSCCM.demo.local\files\.git-credentials | my-gitlab-username | glpat_token3example | NA | NA | Section: NA Object Name: NA Target URL: gitlab.com Target Server: gitlab.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .git-credentials | \\2012SERVERSCCM.demo.local\files\.git-credentials | username4 | ghp_token4example | NA | NA | Section: NA Object Name: NA Target URL: company-git.example.com Target Server: company-git.example.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .netrc | \\2012SERVERSCCM.demo.local\files\.netrc | exampleuser | examplepass | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: example.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .netrc | \\2012SERVERSCCM.demo.local\files\.netrc | anotheruser | anotherpass | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: another-site.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .netrc | \\2012SERVERSCCM.demo.local\files\.netrc | ftpuser | ftppass | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: ftp.myserver.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .netrc | \\2012SERVERSCCM.demo.local\files\.netrc | defaultuser | defaultpass | NA | NA | Section: NA Object Name: NA Target URL: NA Target Server: account-required.com Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | dbvis.xml | \\2012SERVERSCCM.demo.local\files\dbvis.xml | db_user | mydbvispasswordinclr | +mQwYxIFaEjZ/MWJDkm1SCWhHw7xPXWd | NA | Section: NA Object Name: NA Target URL: NA Target Server: localhost Target Port: 3306 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | remmina.pref | \\2012SERVERSCCM.demo.local\files\remmina.pref | NA | NA | A123kgXlYRiCAdDcbFsE8SAoCGUanspg123= | NA | Section: remmina_pref Object Name: Remmina Configuration Target URL: NA Target Server: NA Target Port: NA Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .remmina | \\2012SERVERSCCM.demo.local\files\.remmina | myusername | mysecretpassword | NA | NA | Section: NA Object Name: VNC Target URL: NA Target Server: 192.168.1.10 Target Port: 5500 Database: NA Domain: NA
2012SERVERSCCM.demo.local | files | .remmina | \\2012SERVERSCCM.demo.local\files\.remmina | sshuser | NA | NA | /home/user/.ssh/id_rsa | Section: NA Object Name: SSH Target URL: NA Target Server: 192.168.1.20 Target Port: NA Database: NA Domain: NA

## ShareGraph

This sectin include an experimental interactive graph for exploring share relationships.
Nodes: 0 Edges: 0
Selected Node: None
Graph ToolBar
Seach Nodes
0
Find Paths
Node Types
Identity
Computer
Share Name
Share Path
Folder Group
Edge Types
owner_of
has_privilege_on
hosted_on
child_of
Show Edge Labels Show Node Labels Hide Unselected
Select Center Expand Show Hide View Set Src Set Dest

Content goes here...

## Edge Details

Content goes here...

## Exploit

This section provides some tips for exploiting share access. Consider reviewing this blog for reference.

Share | Access | Instructions
--- | --- | ---
C$, admin$ | READ | Read OS and Application password files and log in. Identify non-public information disclosure.
C$, admin$ | WRITE | Read OS and Application password files and log in. Identify non-public information disclosure. Execute arbitrary code by writing files to autorun locations: DLL Hijacking All Users folders Other file based autoruns EXE Replacement
wwwroot,inetpub,webroot | READ | Read connection strings and escalation through database. Code - search for file types Code - search for file contents
wwwroot,inetpub,webroot | Write | Read connection strings and escalation through database. Upload webshell to execute as web server service account.

## Detect

This section provides some tips for detecting potentially malicious share scanning events.

Action | Detection Guidance
--- | ---

Detect Share Scanning

Data Sources
Ensure that group policy audit settings are configured so that authentication successes and failures are logged so that real-time analysis and offline analysis can be used to identify common indicators of compromise. Specifically, ensure the following events IDs are logged and forward to a SIEM solutions.
Logon Success
- Windows Server 2003: 540
- Windows Server 2008-2012: 4624
Logon Failure
- Windows Server 2003: 680
- Windows Server 2008-2012: 4625
Network Share Object was Accessed - All versions: 5140
Detection Thresholds and Indicators
Below is a list of common Indicators of Compromise (IoCs) that can be used to identify potentially SMB scanning. Please note that not all IoCs will work in every environment due false positives generated by legitimate applications and processes. However, in some environments it may be possible to modify IoC thresholds or signatures to reduce the number of false positives to an acceptable level.
Consider creating correlation rules based on Active Directory and Local Windows authentication logs for:
A single system authenticates to many systems via SMB (port 445) in short period of time, and accesses Windows shares. For example, ten or more systems in under a minute. Use the events above to build detections.
Consider implementing a honey pot or canary system that supports SMB shares that can be used to generate alerts when accessed.
Prevention
If network shares are not required, disable them or block access using host-based firewalls. Ensure that sensitive information is not available on these shares. To restrict access under Windows, open Explorer, right-click on each of the shares, go to the 'Sharing' tab, and click on 'Permissions'. From here, add or remove permissions for various users and groups. Guest access to the system should also be revoked and ensure that adequate access controls are in place for each shared resource. NULL sessions should be disabled.

Detect Canaries | Build detections for authenticated share access read/write access.

## Remediate

This section provides some tips for prioritizing the remediation of shares configured with excessive privileges.

Share Access | Impact | Description
--- | --- | ---

High Risk Shares

Confidentiality, Integrity, Availability, Code Execution
High likelihood.

Remediate high risk shares. In the context of this report, high risk shares have been defined as shares that provide unauthorized remote access to systems or applications. By default, that includes wwwroot, inetpub, c$, and admin$ shares. However, additional exposures may exist that are not called out beyond that.

Write Access Shares | Confidentiality, Integrity, Availability, Code Execution | Remediate shares with write access. Write access to shares may allow an attacker to modify data, insert their own users into configuration files to access applications, or leverage write access to execute code on remote systems. Folders that provide write access could also fall victem to ransomware attacks.
Read Access Shares | Confidentiality,Code Execution | Remediate shares with read access. Read access may provide an attacker with unauthorized access to sensitive data and stored secrets such as passwords and private keys that could be used to gain unauthorized access to systems, applications, and databases.
Top Share Names | NA | Sub prioritize remediation based on top groups of share names(most common share names). When a large number of systems are configured with the same share, they often represent weak configurations associated with applications and processes.
Top Share Groups | NA | Sub prioritize remediation based on top share groups that have the same list of files in their directory. This is another way to identify systems that are configured with the same share are associated with the same insecure application deployment or process.

Sub Prioritzation Tips

NA

Use the detailed .csv files to:
1. Identify share owners with the ShareOwner field. Filter out "BUILTIN\Administrators", "NT AUTHORITY\SYSTEM", and "NT SERVICE\TrustedInstaller" to identify potential asset owners.
2. Filter out shares with a FileCount of 0.
3. Sort shares by LastModifiedDate.
4. Filter for keywords in the FileList.
For example, simple keywords like sql, database, backup, password, etc can help identify additional high risk exposures quickly.

## Scan Information

The PowerHuntShares audit script was run against the demo.local Active Directory domain to collect SMB Share data, generate this HTML summary report, and generate the associated csv files that detail potentially excessive share configurations. Below is a the scan summary and an overview of how to use this report.
The scan context and run time information have been provided below.

Domain | demo.local
DC | DomainController1.demo.local
Start Time | 11/07/2024 08:08:31
Stop Time | 11/07/2024 08:10:31
Duration | 00:02:00.4366393
Src Host | workstation10
Src IPs | 192.168.40.156 192.168.1.234
Src User | demo\testuser

#### How do I use this report?

Follow the guidance below to get the most out of this report. Click each step for more information.
Review the reports and data insights to get a quick feel for the level of SMB share exposure in your environment.
Reports
The Scan, Computer, Share, and ACL summary sections will provide a summary of the results.
Data Insights
The Data Insights sections are intented to highlight natural data groupings that can help centralize and expedite remediation on scale in Active Directory environments.
Review potentially excessive share ACL entry details in the associated HTML and CSV files.
Review the definitions below to ensure you understand what was targeted and how privileges have been qualified as excessive.
Excessive Privileges
In the context of this report, excessive read and write share permissions have been defined as any network share ACL containing an explicit entry for the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups. All provide domain users access to the affected shares due to privilege inheritance.
Please note that share permissions can be overruled by NTFS permissions. Also, be aware that testing excluded share names containing the following keywords: "print$", "prnproc$", "printer", "netlogon",and "sysvol".
High Risk Shares
In the context of this report, high risk shares have been defined as shares that provide unauthorized remote access to a system or application. By default, that includes wwwroot, inetpub, c$, and admin$ shares. However, additional exposures may exist that are not called out beyond that.
Follow the guidance in the Exploit Share Access, Detect Share Access, and Prioritize Remediation sections.
Collect SMB Share data and generate this HTML report by running Invoke-HuntSMBShares.ps1 audit script.
The command examples below can be used to identify potentially malicious share permissions.
From Domain System
Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\
From Non-Domain System
runas /netonly /user:domain\user PowerShell.exe
Import-Module Invoke-HuntSMBShares.ps1
Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\ -DomainController 10.1.1.1 -Username domain\user -Password password