Read domain shares, SYSVOL and NETLOGON for useful artifacts

Needs: Reachable SMB plus share/object read rights in the chosen identity context

Inventory, then test the object

REM Inventory, then test the object
net view \\DC_HOST
dir \\DC_HOST\SYSVOL
dir \\DC_HOST\NETLOGON

Inventory, then test the object

# Inventory, then test the object
nxc smb DC_IP -d DOMAIN -u USER -p 'PASSWORD' --shares
smbclient -L //DC_IP -U 'DOMAIN/USER'
smbclient //DC_IP/SYSVOL -U 'DOMAIN/USER' -c 'recurse ON; ls'
smbclient //DC_IP/SHARE -U 'DOMAIN/USER'

Inside smbclient, use ls, cd, get FILE and a harmless approved put only when write validation is needed. Share listing, share connection, file read and file write are separate permissions.

Verify → Prove read access and actual artifact content; keep recovered real secrets private.

If it fails → Share listing denial does not necessarily deny a known share path, and login success does not guarantee object read access. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
SMB/RPC endpoints, domain clues or new credentials → Enumerate SMB/RPC shares, files and identities
Needs: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Read domain shares, SYSVOL and NETLOGON for useful artifacts

USE WHEN: A valid domain identity and accessible file services
STARTING ACCESS: A known domain identity or a directory endpoint that permits the selected anonymous query
RESULT: Policy/scripts/configuration and typed credential or host clues

Recognize the clue

Enumerate the DC/known file-server shares and inspect relevant SYSVOL/NETLOGON paths under the accepted domain identity.

net view \\DC_HOST
dir \\DOMAIN\SYSVOL
dir \\DOMAIN\NETLOGON

SYNTHETIC EXAMPLE OUTPUT

NETLOGON contains LOGIN_SCRIPT
Readable script references SERVICE_ACCOUNT and CONFIG_PATH

Means: A real domain-readable script gives concrete identity/path leads for credential and host investigation.

Confirm: Verify readable artifact content, whether any secret is current and what account/service it belongs to.

After validation: The artifact yields a typed usable credential or access clue: follow that specific transition.
Ruled out in this context: The script only contains non-sensitive public settings: reject a credential-disclosure inference.
Still inconclusive: Share listing denial without a known-path read test does not settle object access.

Troubleshooting: Share listing denial does not necessarily deny a known share path, and login success does not guarantee object read access.

Additional prerequisite checks

dir \\DOMAIN\SYSVOL
dir \\DOMAIN\NETLOGON

Inventory, then test the object

Inside smbclient, use ls, cd, get FILE and a harmless approved put only when write validation is needed. Share listing, share connection, file read and file write are separate permissions.

Inspect authorized readable policy/logon/deployment paths for scripts, configurations, backups, connection strings and legacy Group Policy Preferences XML containing cpassword. Selectively retrieve relevant files; do not bulk-copy a share merely because it is readable. A discovered secret returns to the credential-classification procedure.

Why it works

Domain-readable scripts and policy artifacts can disclose paths, service accounts or historical secrets. A script's presence does not prove that its credentials are current or that it runs with high privilege.

Worked example · hypothetical

Observation: a readable login script references a backup account. Test: inspect the relevant configuration and validate any recovered secret in context. Illustrative output: a credential opens another share. Interpretation: re-enumerate that identity's available objects.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗