ShawnDEvans / smbmap

SMBMap is a handy SMB enumeration tool
GNU General Public License v3.0
1.76k stars 343 forks source link

Add file write check for WRITE permission #65

Closed Hackndo closed 3 years ago

Hackndo commented 3 years ago

Currently smbmap checks if it can create a directory in a remote share to check if the user has WRITE permission. The issue is that a share can restrict write permission to create files only, but not create directories. Here is an example:

image

Thus if creating an empty dir fails, smbmap shouldn't stop there and should try and create an empty file with minimal permissions (FILE_WRITE_DATA).

This pull request adds this feature to limit the number of false negative.

Before: image

After: image

(PS: These screenshots are using hackthebox RE box, which is retired, so it is not a spoil as the solution for this box has been officially released)

Hackndo commented 3 years ago

@ippsec detailed the issue here https://youtu.be/YXAakamjO_I?t=467

ShawnDEvans commented 3 years ago

This is awesome! I hadn't realized there was a permissions distinction between file write and directory write.