NetExec: SMB: incorrect share permissions
Describe the bug Working on Proving Grounds machine Craft2 from Offsec , I encountered a situation when NetExec reported share permissions as READ only, even though WRITE was allowed (and actually required for exploitation).
To Reproduce List SMB shares:
┌──(kali㉿kali)-[~/craft2]
└─$ nxc smb 192.168.229.188 -u thecybergeek -p winniethepooh --shares
SMB 192.168.229.188 445 CRAFT2 [*] Windows 10 / Server 2019 Build 17763 x64 (name:CRAFT2) (domain:CRAFT2) (signing:False) (SMBv1:False)
SMB 192.168.229.188 445 CRAFT2 [+] CRAFT2\thecybergeek:winniethepooh
SMB 192.168.229.188 445 CRAFT2 [*] Enumerated shares
SMB 192.168.229.188 445 CRAFT2 Share Permissions Remark
SMB 192.168.229.188 445 CRAFT2 ----- ----------- ------
SMB 192.168.229.188 445 CRAFT2 ADMIN$ Remote Admin
SMB 192.168.229.188 445 CRAFT2 C$ Default share
SMB 192.168.229.188 445 CRAFT2 IPC$ READ Remote IPC
SMB 192.168.229.188 445 CRAFT2 WebApp READ
Share WebApp has only permission READ listed. We can however upload a file in this share:
┌──(kali㉿kali)-[~/craft2]
└─$ echo test > test.txt
┌──(kali㉿kali)-[~/craft2]
└─$ nxc smb 192.168.229.188 -u thecybergeek -p winniethepooh --share WebApp --put-file test.txt '\\test.txt'
SMB 192.168.229.188 445 CRAFT2 [*] Windows 10 / Server 2019 Build 17763 x64 (name:CRAFT2) (domain:CRAFT2) (signing:False) (SMBv1:False)
SMB 192.168.229.188 445 CRAFT2 [+] CRAFT2\thecybergeek:winniethepooh
SMB 192.168.229.188 445 CRAFT2 [*] Copying test.txt to \\test.txt
SMB 192.168.229.188 445 CRAFT2 [+] Created file test.txt on \\WebApp\\\test.txt
┌──(kali㉿kali)-[~/craft2]
└─$ nxc smb 192.168.229.188 -u thecybergeek -p winniethepooh --share WebApp --get-file '\\test.txt' verify.txt
SMB 192.168.229.188 445 CRAFT2 [*] Windows 10 / Server 2019 Build 17763 x64 (name:CRAFT2) (domain:CRAFT2) (signing:False) (SMBv1:False)
SMB 192.168.229.188 445 CRAFT2 [+] CRAFT2\thecybergeek:winniethepooh
SMB 192.168.229.188 445 CRAFT2 [*] Copying "\\test.txt" to "verify.txt"
SMB 192.168.229.188 445 CRAFT2 [+] File "\\test.txt" was downloaded to "verify.txt"
┌──(kali㉿kali)-[~/craft2]
└─$ cat verify.txt
test
Expected behavior Correctly recognize share permissions.
NetExec info
- OS: Kali
- Version of nxc: 1.1.0
- Installed from: github (
pipx install git+https://github.com/Pennyw0rth/NetExec
About this issue
- Original URL
- State: open
- Created 4 months ago
- Comments: 22 (5 by maintainers)
I will create a separate issue there. Nevertheless, the change in neff-fix-share-privs probably makes sense to merge as it can help in different scenarios.
@mpgn Weirdly, I am actually able to successfully delete the directory using smbclient.
I don’t think so. I can try to give you more details regarding the error, but sadly without having subscription from Offsec, you probably cannot have access to the machine :face_exhaling:
I did a small change to print more details:
I think I understand why, can you delete the directory you just created ?
We check if you can create and delete, but if delete fails, then it’s like create didn’t work either
So my guess, you can create but not delete which seem about what we saw on the get acl output
So yep, this is a bug, congratz for the finding ! 🎉
https://github.com/Pennyw0rth/NetExec/blob/fe179b006a7bdca7887af67e60b0afe80e4fd9f2/nxc/protocols/smb.py#L743C20-L744C68