Enumerating Domain Shares
To wrap up our manual enumeration discussion,
we’ll shift our focus to domain shares.
Domain shares often contain critical information about the environment,
that we can use to our advantage.
We’ll use PowerView’s Find-DomainShare function to find the shares in the domain.
We could also add the -CheckShareAccess flag
to display shares only available to us.
However, we’ll skip this flag for now to return a full list,
including shares we may target later.
Note that it may take a few moments for PowerView
to find the shares and list them.
The output reveals shares from three different servers.
Although some of these are default domain shares,
we should investigate each of them in search of interesting information.
In this instance, we’ll first focus on SYSVOL,
as it may include files and folders that reside on the domain controller itself.
This particular share is typically used for various domain policies and scripts.
By default, the SYSVOL folder is mapped to
%SystemRoot%\SYSVOL\Sysvol\domain-name
on the domain controller and every domain user has access to it.
During an assessment,
we should investigate every folder we discover in search of interesting items.
For now, let’s examine the Policies folder:
All the folders are potentially interesting,
but we’ll explore oldpolicy first.
Within it,
we find a file named old-policy-backup.xml:
Due to the naming of the folder and the name of the file itself,
it appears that this is an older domain policy file.
This is a common artifact on domain shares as system administrators
often forget them when implementing new policies.
In this particular case, the XML file describes an old policy
(helpful for learning more about the current policies)
and an encrypted password for the local built-in Administrator account.
The encrypted password could be extremely valuable for us.
Historically, system administrators often changed local workstation password
through Group Policy Preferences (GPP).
However, even though GPP-stored passwords are encrypted with AES-256,
the private key for the encryption has been posted on MSDN.
We can use this key to decrypt these encrypted passwords.
In this case, we’ll use the gpp-decrypt ruby script in Kali Linux
that decrypts a given GPP encrypted string:
We successfully decrypted the password
and we will make a note of this in our documentation.
Our Find-DomainShare output also revealed other shares of potential interest.
Let’s check out docshare on FILES04.corp.com
(which is not a default share).
Farther in the folder structure,
we find a do-not-share folder that contains start-email.txt:
Although this is a very strange name for a folder that is in fact shared,
let’s check out the content of the file:
According to the text in this file,
jeff stored an email with a possible cleartext password:
HenchmanPutridBonbon11!
Although the password may have been changed,
we will make a note of it in our documentation.
Between this password and the password we discovered earlier,
we’re building a rough profile of the password policy
used for both users and computers in the organization.
We could use this to create specific wordlists
that we can use for password guessing and brute force, if needed.