SMB Share Enumeration and Credential Discovery
Started with credentials for tdoudney and listed shares on 172.30.0.22 (IT, CustomerDev, Home, plus the default SYSVOL/NETLOGON/C$/ADMIN$/IPC$). The IT share held logon.cmd (drive mappings) and netssh.cmd (a proxy config pointing at proxy.falsimentis.com:3128). The Home share exposed every user's directory; csparkes was correctly locked (ACCESS_DENIED) but tdoudney's own directory held backup.ps1 and backup.ps1.OLD. The current script used Get-Credential correctly, but the .OLD version hardcoded ConvertTo-SecureString 'Clippers2022' for falsimentis.com\csparkes. Reusing csparkes/Clippers2022 opened the CustomerDev share, which contained a web app tree and db.backup.sql.zip (33.8 MB).
Commands
1. Confirm the target and enumerate shares
nmap confirmed only 172.30.0.22 was up with 139/netbios-ssn and 445/microsoft-ds open. smbclient -L listed the shares. Passing credentials inline as user%pass avoids the prompt; the SMB1 workgroup-listing failure at the end is expected because SMB1 is disabled.
sudo nmap -sT -p 139,445 172.30.0.2-254 smbclient -L //172.30.0.22 -U tdoudney%Falsimentis123
2. Read the IT share scripts
The IT share held logon.cmd and netssh.cmd. logon.cmd mapped drives (net use z: \\FLSM-NAS\Users), and netssh.cmd set a WinHTTP proxy to proxy.falsimentis.com:3128. Logon scripts are reconnaissance gold: they name internal hosts, shares, and the proxy an attacker would route through.
smbclient //172.30.0.22/IT -U tdoudney%Falsimentis123 get logon.cmd get netssh.cmd
3. Browse Home and check per-user ACLs
The Home share exposed csparkes, ttidmas, and tdoudney directories. csparkes was correctly protected (NT_STATUS_ACCESS_DENIED on ls), but tdoudney's own directory was readable and held backup.ps1, backup.ps1.OLD, and a ScoutSuite report.
smbclient //172.30.0.22/Home -U tdoudney%Falsimentis123 cd csparkes ls cd ../tdoudney ls
4. Exfiltrate the home directory in one command
smbclient's built-in tar streamed the whole directory (16.2 MB) into a single local tarball, then extracted it. One command exfiltrates an entire share path, no per-file get loop needed.
tar c tdoudney-home.tar # locally: tar xf tdoudney-home.tar
5. Recover the hardcoded credential
backup.ps1 correctly used Get-Credential (interactive, no stored secret). But backup.ps1.OLD hardcoded ConvertTo-SecureString 'Clippers2022' -AsPlainText -Force for falsimentis.com\csparkes. Someone fixed the live script and left the password sitting in the .OLD copy.
cat backup.ps1 cat backup.ps1.OLD
6. Reuse the credential for lateral movement
csparkes/Clippers2022 opened the CustomerDev share, which held a full web application tree (index.php, install.php, version.php, engine/, mod/) and db.backup.sql.zip at 33.8 MB. A stale password in one user's home directory became read access to another user's database backup.
smbclient //172.30.0.22/CustomerDev -U csparkes%Clippers2022 cd FS ls
Key Findings
- Home share exposed all user directories; csparkes correctly denied, tdoudney readable
- backup.ps1.OLD hardcoded 'Clippers2022' for falsimentis.com\csparkes
- Live backup.ps1 correctly used Get-Credential; the leak was only in the .OLD copy
- csparkes/Clippers2022 opened CustomerDev, exposing db.backup.sql.zip (33.8 MB)
- smbclient tar exfiltrated a 16.2 MB home directory in one command
Security Controls
- Secret management for service and backup credentials (no plaintext in scripts)
- Least-privilege share ACLs (per-user private home directories)
- Removal of stale .OLD/.bak script copies
- SMB access and file-read auditing
- Credential rotation on discovery of exposure