Skip to content

Latest commit

 

History

History
56 lines (39 loc) · 2.72 KB

T1077.md

File metadata and controls

56 lines (39 loc) · 2.72 KB

T1077 - Windows Admin Shares

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$.

Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels. (Citation: Microsoft Admin Shares)

The Net utility can be used to connect to Windows admin shares on remote systems using net use commands with valid credentials. (Citation: Technet Net Use)

Atomic Tests


Atomic Test #1 - Map admin share

Connecting To Remote Shares

Supported Platforms: Windows

Inputs

Name Description Type Default Value
share_name Examples C$, IPC$, Admin$ String C$
user_name Username String DOMAIN\Administrator
password Password String P@ssw0rd1
computer_name Target Computer Name String Target

Run it with command_prompt!

cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"


Atomic Test #2 - Map Admin Share PowerShell

Map Admin share utilizing PowerShell

Supported Platforms: Windows

Inputs

Name Description Type Default Value
share_name Examples C$, IPC$, Admin$ String C$
computer_name Target Computer Name String Target
map_name Mapped Drive Letter String g

Run it with powershell!

New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}