Share hunting

In an Active Directory domain, SMB shares (departmental, user home, SYSVOL) tend to accumulate secrets nobody cleans up: deployment scripts with passwords, web.config files, unattend.xml, backups, .kdbx, spreadsheets. Share hunting is combing those shares across the network with low-privilege credentials to find the credential that grants the next hop. It exploits no software bug, but rather loose NTFS permissions and the habit of storing secrets in places readable by many.

Mechanism

With domain credentials we first enumerate the accessible shares and their permissions per host. netexec does this in bulk against a list of machines:

netexec smb <ip> -u <user> -p <pass> --shares

To avoid downloading everything by hand, the spider_plus module walks a share and catalogs the interesting files by extension and size, leaving a JSON with the paths:

netexec smb <ip> -u <user> -p <pass> -M spider_plus --share 'Department Shares'

Snaffler does the same from a domain-joined Windows host, but also classifies findings by criticality (flags in green files that look like they hold secrets), which cuts noise in huge shares:

Snaffler.exe -s -d <domain> -o snaffler.log -v data

Once a promising file is found, we download it with smbclient (recursive if needed) and read the credentials:

smbclient //<ip>/'Department Shares' -U <domain>/<user>%<pass> -c 'recurse ON; prompt OFF; mget *'

It is also worth hunting for passwords in SYSVOL (logon scripts, GPO autologon Registry.xml) and in the Description field of AD accounts, where credentials sometimes appear.

Requirements

Valid domain credentials (even low-privilege) and read access to some share. The value depends on how careless the environment is; it is an iterative process: each new credential can open shares the previous one could not see, so it is worth repeating the hunt with every account obtained.

How to detect it. Hunting is given away by sequential, bulk access to many shares and files by an account that rarely does so, broad reads of SYSVOL/Department Shares, and the signature of tools such as Snaffler or netexec's spider_plus module. 5140/5145 events (file-share object access) in anomalous volume from a single source are the main signal.

Defence. Apply least privilege to NTFS and share permissions; do not store secrets in cleartext on shares (use secret managers and gMSA); review SYSVOL for embedded passwords; and audit access to sensitive resources. It is the network version of local credential hunting, a sibling of credentials in source and cPassword in GPP, part of SMB access, and leads to credential reuse.