> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-services/smb-windows-admin-shares.md). # SMB/Windows Admin Shares ## Checking for Access ### From a Windows machine One way to validate share access is to list the content of `C$` on the remote machine in PowerShell: ```powershell ls \\192.168.88.129\C$ Get-ChildItem \\192.168.88.129\C$ ``` ## List Windows Shares ### With net.exe To list non-standard share on a remote machine with `net.exe` ```bash net view \\192.168.88.129 ``` To list all shares, including the standard hidden shares ```batch net view \\192.168.88.129 /all ``` ### With PowerShell To list Windows shares on a remote machine with `Get-CimInstance` ```powershell Get-CimInstance -Class win32_share -ComputerName 192.168.88.129 ``` To list Windows shares on a remote machine with `Get-WmiObject` ```powershell Get-WmiObject -Class win32_share -ComputerName 192.168.88.129 ``` ### With smbclient To list Windows shares on a remote machine with `smbclient` ```bash smbclient -L 10.129.1.12 ``` ## Connect to shares ### With smbclient To connect to a share with `smbclient` with out any password (`-N` parameter) ```bash smbclient -N //10.129.1.12/WorkShares ``` Then navigate directories with `cd` and list files with `ls`. Use `get` or `mget` to download files. ## Resources **Get-WmiObject** - Microsoft Learn: **net** (command) - Wikipedia: **Net view** - Microsoft Learn: SMB/Windows Admin Shares - Mitre ATT\&CK: Win32\_Share - powershell.one: