rapid7/metasploit-framework — pull request #3569 by altjx (2014-07-25 03:55:51+00:00)
Title: Updated smb_enumshares to support share spidering

My first PR involved me submitting an smb_spider module that enumerated shares from systems accessible via local administrator credentials. From this list, it would be possible to grep the results and look for sensitive files (i.e., password files, files containing PII, etc.).

I've taken the suggestion and modified smb_enumshares to also be able to provide this functionality. I've removed the "DIR_SHARE" option that was there before, since this only provided the directory listing of the root shares accessible, and added some spidering options instead.

Quick description of four options I've added:

* **SpiderShares** - When enabled, smb_enumshares will attempt to recursively get the directory listing for all shares accessible using the given credentials.
* **SpiderProfiles** - When enabled, smb_enumshares will only recursively spider user profile directories (e.g., Documents, Pictures, Music, Desktop, etc.) as opposed to the entire C$ drive. This is pretty beneficial considering most important files stored by users would reside in these directories and not "C:\Windows\fonts" for example.
* **MaxDepth** - This specifies the number of subdirectories to spider. So if this is set to 0, then smb_enumshares will only spider the root directory of all accessible shares. If it's set to 1 for example, then it'll spider the root directory + one more level down the folder structure.
* **LogSpider** - Previously, "DIR_SHARE" option would log to one particular format, but I've modified the logging so that people can either export to CSV, display the table output in the log, or just store one-liners in the logs (demonstrated in an example below).

# Screenshots

Smb_enumshares options:
![Image of smb_enumshares options]
(https://dl.dropboxusercontent.com/u/2526790/smb_spider_msf/options.jpg)

Spidering the root of shares (spidering only user profiles in C$ turned on):
![Image of smb_enumshares spidering the root of user profiles]
(https://dl.dropboxusercontent.com/u/2526790/smb_spider_msf/profile_spider.png)

Spidering the root of all shares (spidering only user profiles in C$ turned off):
![Image of smb_enumshares spidering the root of all accessible shares]
(https://dl.dropboxusercontent.com/u/2526790/smb_spider_msf/spider_root_all_shares.png)

# Console Output
```
msf auxiliary(smb_enumshares) > show options

Module options (auxiliary/scanner/smb/smb_enumshares):

Name Current Setting Required Description
---- --------------- -------- -----------
LogSpider 0 no 1 = CSV, 2 = table (txt), 3 = one liner (txt)
MaxDepth 0 yes Max number of subdirectories to spider
RHOSTS 192.168.0.92 yes The target address range or CIDR identifier
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass Password1 no The password for the specified username
SMBUser Administrator no The username to authenticate as
SpiderProfiles false no Spider only user profiles when share = C$
SpiderShares true no Spider shares recursively
THREADS 1 yes The number of concurrent threads
USE_SRVSVC_ONLY false yes List shares only with SRVSVC
VERBOSE true yes Show detailed information when spidering

msf auxiliary(smb_enumshares) > run

[*] 192.168.0.92:139 - Windows XP Service Pack 2 (English)
[+] 192.168.0.92:139 - IPC$ - (IPC) Remote IPC
[+] 192.168.0.92:139 - Desktop - (DISK)
[+] 192.168.0.92:139 - test - (DISK)
[+] 192.168.0.92:139 - ADMIN$ - (DISK) Remote Admin
[+] 192.168.0.92:139 - C$ - (DISK) Default share
[+] 192.168.0.92:139 \\VULN-XP-VM\Desktop (DISK) - Readable
=======================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC blazesploit.plf 02-26-2014 23:27:52 03-19-2014 17:45:49 02-26-2014 23:27:52 02-26-2014 23:28:22 544
ARC DragonR.m3u 02-28-2014 02:43:34 03-06-2014 12:50:37 03-06-2014 12:50:37 03-06-2014 12:50:37 8192
ARC Easy RM to MP3 Converter.lnk 02-12-2014 00:36:27 07-01-2014 10:36:02 02-12-2014 00:36:27 02-12-2014 00:36:27 4096
ARC Eureka Email.lnk 03-06-2014 12:47:21 07-01-2014 10:36:02 03-06-2014 12:47:21 03-06-2014 12:47:21 4096
ARC IDA Pro Free.lnk 04-21-2014 19:51:23 07-01-2014 10:36:02 04-21-2014 19:51:23 04-21-2014 19:51:23 4096
ARC Minecraft Launcher.exe 03-19-2014 17:18:23 03-24-2014 15:40:39 03-19-2014 17:18:24 05-17-2014 15:23:29 1769472
ARC Minecraft.lnk 03-19-2014 17:17:35 07-01-2014 10:36:02 03-19-2014 17:17:35 03-19-2014 17:17:35 4096
ARC test.exe 03-24-2014 16:23:58 05-17-2014 15:23:31 03-24-2014 16:24:03 05-17-2014 15:23:29 3538944
ARC New Bitmap Image.bmp 03-09-2014 21:38:46 04-23-2014 00:07:39 03-09-2014 21:38:47 03-09-2014 21:39:17 905216
ARC script.pl 02-26-2014 16:28:52 03-06-2014 17:22:00 03-06-2014 17:22:00 03-06-2014 17:22:00 4096
ARC SORITONG.lnk 02-26-2014 20:01:11 07-01-2014 10:36:02 02-26-2014 20:01:11 02-26-2014 20:01:11 648
ARC ui.txt 02-26-2014 20:03:46 02-26-2014 21:39:07 02-26-2014 21:34:22 02-26-2014 21:39:10 4096
ARC nc.exe 02-22-2014 22:09:42 03-19-2014 17:37:06 02-22-2014 22:09:42 07-24-2014 21:34:41 61440
DIR test 02-13-2014 15:13:46 07-24-2014 21:29:52 03-06-2014 14:44:25 06-20-2014 13:28:10 0

[+] 192.168.0.92:139 \\VULN-XP-VM\test (DISK) - Readable
====================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC test.txt 02-13-2014 15:13:51 07-24-2014 22:15:53 07-24-2014 22:15:53 07-24-2014 22:15:53 16
DIR anotherfolder 03-06-2014 14:44:19 07-24-2014 21:36:48 03-06-2014 14:44:31 03-06-2014 14:44:31 0

[+] 192.168.0.92:139 \\VULN-XP-VM\C$\ (DISK) - Readable - Writable
==============================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC AUTOEXEC.BAT 07-18-2013 23:05:48 07-18-2013 23:05:48 07-18-2013 23:05:48 07-18-2013 23:05:48 0
ARC msgbox.exe 04-23-2014 00:08:52 04-23-2014 00:09:21 04-23-2014 00:08:29 04-23-2014 04:07:09 16384
ARC CONFIG.SYS 07-18-2013 23:05:48 07-18-2013 23:05:48 07-18-2013 23:05:48 07-18-2013 23:05:48 0
DIR Documents and Settings 07-18-2013 18:01:38 07-24-2014 21:24:50 03-19-2014 17:48:12 03-19-2014 17:48:12 0
DIR Console2 02-12-2014 00:35:25 07-24-2014 21:36:48 02-12-2014 00:35:25 02-12-2014 00:35:25 0
DIR cygwin 04-21-2014 17:48:16 07-24-2014 21:36:48 04-21-2014 18:46:32 04-21-2014 18:46:32 0
DIR dc0737d06fbf55ec3d66dbb360 02-27-2014 12:04:46 07-24-2014 21:36:48 02-27-2014 12:05:07 02-27-2014 12:05:07 0
DIR Dev-Cpp 02-17-2014 16:25:20 07-24-2014 21:24:55 02-17-2014 16:44:07 02-17-2014 16:44:07 0
DIR AntDSData 02-22-2014 21:59:57 07-24-2014 21:36:48 02-22-2014 21:59:57 02-22-2014 21:59:57 0
DIR AntDSWorkDir 02-22-2014 21:59:57 07-24-2014 21:36:48 02-22-2014 21:59:57 02-22-2014 21:59:57 0
DIR WINDOWS 07-18-2013 17:59:29 07-24-2014 21:24:50 07-01-2014 10:35:56 07-01-2014 10:35:56 0
DIR xampp 07-20-2013 18:19:12 07-24-2014 21:24:56 07-20-2013 18:21:42 07-20-2013 18:21:42 0
DIR Python27 02-12-2014 00:39:27 07-24-2014 21:34:46 02-12-2014 00:40:05 02-12-2014 00:40:05 0
DIR test 02-26-2014 23:19:53 07-24-2014 21:36:49 02-28-2014 03:03:56 02-28-2014 03:03:56 0
DIR Tools 02-13-2014 21:50:36 07-24-2014 21:36:49 03-19-2014 17:37:06 03-19-2014 17:37:06 0
DIR Perl 02-12-2014 00:40:15 07-24-2014 21:34:46 02-12-2014 00:42:03 02-12-2014 00:42:03 0
Unknown Program Files 07-18-2013 18:02:00 07-24-2014 21:25:56 07-24-2014 21:25:56 07-24-2014 21:25:56 0

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(smb_enumshares) > set SpiderProfiles true
SpiderProfiles => true
msf auxiliary(smb_enumshares) > run

[*] 192.168.0.92:139 - Windows XP Service Pack 2 (English)
[+] 192.168.0.92:139 - IPC$ - (IPC) Remote IPC
[+] 192.168.0.92:139 - Desktop - (DISK)
[+] 192.168.0.92:139 - test - (DISK)
[+] 192.168.0.92:139 - ADMIN$ - (DISK) Remote Admin
[+] 192.168.0.92:139 - C$ - (DISK) Default share
[+] 192.168.0.92:139 \\VULN-XP-VM\Desktop (DISK) - Readable
=======================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC blazesploit.plf 02-26-2014 23:27:52 03-19-2014 17:45:49 02-26-2014 23:27:52 02-26-2014 23:28:22 544
ARC DragonR.m3u 02-28-2014 02:43:34 03-06-2014 12:50:37 03-06-2014 12:50:37 03-06-2014 12:50:37 8192
ARC Easy RM to MP3 Converter.lnk 02-12-2014 00:36:27 07-01-2014 10:36:02 02-12-2014 00:36:27 02-12-2014 00:36:27 4096
ARC Eureka Email.lnk 03-06-2014 12:47:21 07-01-2014 10:36:02 03-06-2014 12:47:21 03-06-2014 12:47:21 4096
ARC IDA Pro Free.lnk 04-21-2014 19:51:23 07-01-2014 10:36:02 04-21-2014 19:51:23 04-21-2014 19:51:23 4096
ARC Minecraft Launcher.exe 03-19-2014 17:18:23 03-24-2014 15:40:39 03-19-2014 17:18:24 05-17-2014 15:23:29 1769472
ARC Minecraft.lnk 03-19-2014 17:17:35 07-01-2014 10:36:02 03-19-2014 17:17:35 03-19-2014 17:17:35 4096
ARC test.exe 03-24-2014 16:23:58 05-17-2014 15:23:31 03-24-2014 16:24:03 05-17-2014 15:23:29 3538944
ARC New Bitmap Image.bmp 03-09-2014 21:38:46 04-23-2014 00:07:39 03-09-2014 21:38:47 03-09-2014 21:39:17 905216
ARC script.pl 02-26-2014 16:28:52 03-06-2014 17:22:00 03-06-2014 17:22:00 03-06-2014 17:22:00 4096
ARC SORITONG.lnk 02-26-2014 20:01:11 07-01-2014 10:36:02 02-26-2014 20:01:11 02-26-2014 20:01:11 648
ARC ui.txt 02-26-2014 20:03:46 02-26-2014 21:39:07 02-26-2014 21:34:22 02-26-2014 21:39:10 4096
ARC nc.exe 02-22-2014 22:09:42 03-19-2014 17:37:06 02-22-2014 22:09:42 07-24-2014 21:34:41 61440
DIR test 02-13-2014 15:13:46 07-24-2014 21:29:52 03-06-2014 14:44:25 06-20-2014 13:28:10 0

[+] 192.168.0.92:139 \\VULN-XP-VM\test (DISK) - Readable
====================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC test.txt 02-13-2014 15:13:51 07-24-2014 22:15:53 07-24-2014 22:15:53 07-24-2014 22:15:53 16
DIR anotherfolder 03-06-2014 14:44:19 07-24-2014 21:36:48 03-06-2014 14:44:31 03-06-2014 14:44:31 0

[+] 192.168.0.92:139 \\VULN-XP-VM\C$\Documents and Settings\Administrator\My Documents (DISK) - Readable - Writable
===============================================================================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC soritong10.zip 02-26-2014 20:00:34 06-20-2014 14:16:00 02-26-2014 20:00:36 02-26-2014 20:00:45 1748992
ARC EasyRMtoMP3Converter.zip 02-12-2014 00:36:17 06-20-2014 14:16:00 02-12-2014 00:36:12 02-12-2014 00:36:12 2965504
DIR Visual Studio 2008 02-27-2014 12:09:16 07-24-2014 21:41:08 02-27-2014 12:30:34 02-27-2014 12:30:34 0
DIR Downloads 07-18-2013 23:12:33 07-24-2014 21:41:08 05-27-2014 16:07:34 05-27-2014 16:07:34 0
DIR Techsmith Snagit 12.0.0 Build 1001 ... 06-19-2014 17:42:48 06-20-2014 14:16:00 06-19-2014 17:42:50 06-19-2014 17:43:07 0
DIR BlazeVideo 02-25-2014 23:22:15 07-24-2014 21:41:08 02-25-2014 23:22:15 02-25-2014 23:22:15 0
DIR Xion 02-28-2014 02:42:22 07-24-2014 21:41:08 02-28-2014 02:42:22 02-28-2014 02:42:22 0
FILE soritong10.exe 02-26-2014 20:00:49 06-20-2014 14:16:00 08-17-2009 00:11:46 03-24-2014 15:38:53 1867776
Unknown My Music 07-18-2013 23:07:30 07-24-2014 21:41:08 07-18-2013 23:07:57 07-18-2013 23:07:57 0
Unknown My Pictures 07-18-2013 23:07:29 07-24-2014 21:41:08 07-18-2013 23:07:57 07-18-2013 23:07:57 0
Unknown My Videos 02-25-2014 23:22:17 07-24-2014 21:41:08 02-25-2014 23:22:17 02-25-2014 23:22:17 0

[+] 192.168.0.92:139 \\VULN-XP-VM\C$\Documents and Settings\Administrator\Desktop (DISK) - Readable - Writable
==========================================================================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC blazesploit.plf 02-26-2014 23:27:52 03-19-2014 17:45:49 02-26-2014 23:27:52 02-26-2014 23:28:22 544
ARC DragonR.m3u 02-28-2014 02:43:34 03-06-2014 12:50:37 03-06-2014 12:50:37 03-06-2014 12:50:37 8192
ARC Easy RM to MP3 Converter.lnk 02-12-2014 00:36:27 07-01-2014 10:36:02 02-12-2014 00:36:27 02-12-2014 00:36:27 4096
ARC Eureka Email.lnk 03-06-2014 12:47:21 07-01-2014 10:36:02 03-06-2014 12:47:21 03-06-2014 12:47:21 4096
ARC IDA Pro Free.lnk 04-21-2014 19:51:23 07-01-2014 10:36:02 04-21-2014 19:51:23 04-21-2014 19:51:23 4096
ARC Minecraft Launcher.exe 03-19-2014 17:18:23 03-24-2014 15:40:39 03-19-2014 17:18:24 05-17-2014 15:23:29 1769472
ARC Minecraft.lnk 03-19-2014 17:17:35 07-01-2014 10:36:02 03-19-2014 17:17:35 03-19-2014 17:17:35 4096
ARC test.exe 03-24-2014 16:23:58 05-17-2014 15:23:31 03-24-2014 16:24:03 05-17-2014 15:23:29 3538944
ARC New Bitmap Image.bmp 03-09-2014 21:38:46 04-23-2014 00:07:39 03-09-2014 21:38:47 03-09-2014 21:39:17 905216
ARC script.pl 02-26-2014 16:28:52 03-06-2014 17:22:00 03-06-2014 17:22:00 03-06-2014 17:22:00 4096
ARC SORITONG.lnk 02-26-2014 20:01:11 07-01-2014 10:36:02 02-26-2014 20:01:11 02-26-2014 20:01:11 648
ARC ui.txt 02-26-2014 20:03:46 02-26-2014 21:39:07 02-26-2014 21:34:22 02-26-2014 21:39:10 4096
ARC nc.exe 02-22-2014 22:09:42 03-19-2014 17:37:06 02-22-2014 22:09:42 07-24-2014 21:34:41 61440
DIR test 02-13-2014 15:13:46 07-24-2014 21:29:52 03-06-2014 14:44:25 06-20-2014 13:28:10 0

[+] 192.168.0.92:139 \\VULN-XP-VM\C$\Documents and Settings\All Users\Desktop (DISK) - Readable - Writable
======================================================================================================

Type Name Created Accessed Written Changed Size
---- ---- ------- -------- ------- ------- ----
ARC AWUS036H Wireless LAN Utility.lnk 02-17-2014 18:53:08 07-01-2014 10:36:02 02-17-2014 18:53:08 02-17-2014 18:53:08 4096
ARC BlazeDVD 5.1 Professional.lnk 02-25-2014 20:10:31 07-01-2014 10:36:02 02-25-2014 20:10:31 02-25-2014 20:10:31 4096
ARC Cygwin Terminal.lnk 04-21-2014 18:46:33 07-01-2014 10:36:02 04-21-2014 18:46:33 04-21-2014 18:46:33 480
ARC Google Chrome.lnk 07-18-2013 23:11:18 07-24-2014 21:34:40 07-24-2014 21:34:40 07-24-2014 21:34:40 4096
ARC Immunity Debugger.lnk 02-12-2014 00:39:14 07-24-2014 21:25:05 02-12-2014 00:39:14 02-17-2014 23:34:18 4096

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(smb_enumshares) >
```

# Console Output (verbosity disabled)
```
msf auxiliary(smb_enumshares) > show options

Module options (auxiliary/scanner/smb/smb_enumshares):

Name Current Setting Required Description
---- --------------- -------- -----------
LogSpider 3 no 1 = CSV, 2 = table (txt), 3 = one liner (txt)
MaxDepth 0 yes Max number of subdirectories to spider
RHOSTS 192.168.0.92 yes The target address range or CIDR identifier
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass Password1 no The password for the specified username
SMBUser Administrator no The username to authenticate as
SpiderProfiles true no Spider only user profiles when share = C$
SpiderShares true no Spider shares recursively
THREADS 1 yes The number of concurrent threads
USE_SRVSVC_ONLY false yes List shares only with SRVSVC
VERBOSE false yes Show detailed information when spidering

msf auxiliary(smb_enumshares) > run

[*] 192.168.0.92:139 - Windows XP Service Pack 2 (English)
[+] 192.168.0.92:139 - IPC$ - (IPC) Remote IPC
[+] 192.168.0.92:139 - Desktop - (DISK)
[+] 192.168.0.92:139 - test - (DISK)
[+] 192.168.0.92:139 - ADMIN$ - (DISK) Remote Admin
[+] 192.168.0.92:139 - C$ - (DISK) Default share
[*] 192.168.0.92:139 - Spidering IPC$.
[*] 192.168.0.92:139 - Spider IPC$ complete.
[*] 192.168.0.92:139 - Spidering Desktop.
[*] 192.168.0.92:139 - Spider Desktop complete.
[*] 192.168.0.92:139 - Spidering test.
[*] 192.168.0.92:139 - Spider test complete.
[*] 192.168.0.92:139 - Spidering C$.
[*] 192.168.0.92:139 - Spider C$ complete.
[+] 192.168.0.92 - info saved in: /root/.msf4/loot/20140724224112_default_192.168.0.92_smb.enumshares_591441.bin
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(smb_enumshares) > exit

root@kali:# cat /root/.msf4/loot/20140724224112_default_192.168.0.92_smb.enumshares_591441.bin
192.168.0.92\Desktop\blazesploit.plf
192.168.0.92\Desktop\DragonR.m3u
192.168.0.92\Desktop\Easy RM to MP3 Converter.lnk
192.168.0.92\Desktop\Eureka Email.lnk
192.168.0.92\Desktop\IDA Pro Free.lnk
192.168.0.92\Desktop\Minecraft Launcher.exe
192.168.0.92\Desktop\Minecraft.lnk
192.168.0.92\Desktop\nc.exe
192.168.0.92\Desktop\New Bitmap Image.bmp
192.168.0.92\Desktop\script.pl
192.168.0.92\Desktop\SORITONG.lnk
192.168.0.92\Desktop\test
192.168.0.92\Desktop\test.exe
192.168.0.92\Desktop\ui.txt
192.168.0.92\test\anotherfolder
192.168.0.92\test\test.txt
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\BlazeVideo
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\Downloads
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\EasyRMtoMP3Converter.zip
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\My Music
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\My Pictures
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\My Videos
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\soritong10.exe
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\soritong10.zip
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\Techsmith Snagit 12.0.0 Build 1001 ...
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\Visual Studio 2008
192.168.0.92\C$\Documents and Settings\Administrator\My Documents\Xion
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\blazesploit.plf
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\DragonR.m3u
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\Easy RM to MP3 Converter.lnk
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\Eureka Email.lnk
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\IDA Pro Free.lnk
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\Minecraft Launcher.exe
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\Minecraft.lnk
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\nc.exe
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\New Bitmap Image.bmp
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\script.pl
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\SORITONG.lnk
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\test
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\test.exe
192.168.0.92\C$\Documents and Settings\Administrator\Desktop\ui.txt
192.168.0.92\C$\Documents and Settings\All Users\Desktop\AWUS036H Wireless LAN Utility.lnk
192.168.0.92\C$\Documents and Settings\All Users\Desktop\BlazeDVD 5.1 Professional.lnk
192.168.0.92\C$\Documents and Settings\All Users\Desktop\Cygwin Terminal.lnk
192.168.0.92\C$\Documents and Settings\All Users\Desktop\Google Chrome.lnk
192.168.0.92\C$\Documents and Settings\All Users\Desktop\Immunity Debugger.lnk
```

Let me know if there are any questions or suggestions.

Thanks.