6.2.2 Enumerate shares, SYSVOL and NETLOGON
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A reachable SMB endpoint and an identified anonymous, local or domain authentication context. These contexts must be recorded separately.
Where to look: Begin with SYSVOL/NETLOGON on a DC and relevant application, deployment or IT shares discovered on scoped hosts. Inspect logon scripts, installation configuration, backups and references to other servers. List before retrieving selected files.
Expected behavior / secure boundary: Domain-user read access to SYSVOL and NETLOGON is generally intentional. Directory listing, file reading and file writing are separate permissions. Share names, dollar suffixes and a READ label do not settle an individual file's effective access.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.2.2.1 Baseline share enumeration from Windows
Run: Windows. Requires: Selected SMB server; current network identity and share/object permissions. Effect: Lists shares/directories; does not test file write or execution.
net view \\DC_HOST
dir \\DC_HOST\SYSVOL
dir \\DC_HOST\NETLOGON
6.2.2.2 Find shares and test useful file access from Kali Share enumeration using Kali SMB clients
Run: Kali / Linux. Requires: SMB connectivity and explicit DOMAIN/USER context; smbclient may prompt for its password. Effect: Lists shares/files; get retrieves only a selected authorized file.
nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD' --shares
smbclient -L //DC_IP -U 'DOMAIN/USER'
smbclient //DC_IP/SYSVOL -U 'DOMAIN/USER' -c 'recurse ON; ls'
smbclient //DC_IP/SHARE -U 'DOMAIN/USER'
What this checks: net view and --shares inventory share-level candidates. smbclient then tests the named share with an explicit identity; ls, cd and get test progressively narrower objects. A successful file read can disclose information without granting execution.
6.2.2.3 Interpret the output
Raw/view evidence first. These are synthetic, abbreviated tool or graph-view excerpts. Graph relationship rows are a representative view, not collector console output. Version-specific wording and spacing can differ. The normalized observations below are a separate interpretation.
6.2.2.3.1 Expected — raw evidence
Command/view: smbclient -L //DC_IP -U DOMAIN/USER
Sharename Type Comment
--------- ---- -------
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share
Decisive clue: SYSVOL and NETLOGON appear in the inventory.
Supported: Share names were listed in this authentication context.
Still missing: Connecting, listing a directory and reading a selected file remain separate operations.
Next check: §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON
6.2.2.3.2 Interesting — raw evidence
Command/view: Selected file retrieval and its contents
smb: \scripts\> get map-drives.ps1
getting file \scripts\map-drives.ps1 as map-drives.ps1
File content:
$share = "\\FS01\Finance"
Decisive clue: FS01 and Finance in the readable script.
Supported: A host/share reference was found through a demonstrated file read.
Still missing: Scope, address, reachability and current-identity access to that share remain untested.
Next check: §6.2.6.1 — Validate host-specific access rights
6.2.2.3.3 Failed / inconclusive — raw evidence
Command/view: get config.ini inside an authenticated share session
NT_STATUS_ACCESS_DENIED opening remote file \config.ini
Decisive clue: The selected file open was denied.
Supported: This file read failed; retain any already-proven authentication/listing.
Still missing: Determine the relevant object permission or use another permitted artifact; do not infer no credentials exist anywhere.
Next check: §6.5.1.1 — Diagnose the failed boundary
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Share: SYSVOL READ
Share: Deploy READ
Deploy/scripts/map-drives.ps1
File content: $share = "\\FS01\Finance"
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| SYSVOL READ | Expected directory access can be available. | Inspect relevant scripts/policy material; do not report readability alone as a weakness. | §6.2.3.1 — Interpret scripts, configuration and exposed secrets |
| map-drives.ps1 | A selected script contains a host/share reference. | Record FS01 and Finance, check scope/address and test access with the current identity. | §6.2.6.1 — Validate host-specific access rights |
| NT_STATUS_ACCESS_DENIED on get | The requested read was denied. | Retain successful authentication/listing evidence; inspect another authorized object. | §6.5.1.1 — Diagnose the failed boundary |
Stop when: The selected share/file access boundary and any useful clue are recorded.
Revisit only when: A new credential, permission or referenced file changes the access context.
6.2.2.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A readable file contains a credential-shaped value: classify its type and identity before reuse. | §6.3.2.1 — Classify recovered credentials and their scope |
| Ruled out in this context | A relevant share is unreadable with this identity: mark that access context ruled out and continue. | §6.2.1.1 — Baseline enumeration — users and groups |
| Inconclusive / failed check | Listing works but file reading is untested: keep the content claim inconclusive. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
6.2.2.5 Tooling and complete procedure
smbclient on Kali is the baseline for explicit SMB file interaction; net.exe/dir are Windows alternatives. NetExec summarizes share candidates. SMB connectivity and correct account scope are required. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.