File shares are where an environment keeps its data, and they are routinely exposed with weak or no authentication, world-readable or world-writable permissions, and legacy protocols. Offensive value is in two directions: reading what the share holds (credentials, backups, documents) and writing to it to gain execution or coerce other users. The area splits by how the files are reached.
Find the file services#
One sweep identifies the file services on a host and points to the right subtopic:
nmap -sV -p21,22,69,111,139,445,548,873,990,2049,80,443 <target>
# 445/139 SMB 2049/111 NFS 548 AFP 21 FTP 990 FTPS 22 SFTP(SSH)
# 69 TFTP(UDP) 873 rsync 80/443 HTTP file server / WebDAV / MFT portal
# quick access probes
nxc smb <target> -u '' -p '' --shares # SMB null-session shares
showmount -e <target> # NFS exports
rsync <target>:: # rsync modules
curl -s -X OPTIONS http://<target>/ -i | grep -i dav # WebDAV
Read the open ports to the subtopic: 445/2049/548 to network file systems, 21/22/69/873 to transfer protocols, and 80/443 serving files to web file access. Then, for each, the recurring questions are the same: is access anonymous or weak, is it readable (loot) or writable (execution and coercion), and does the server implementation have a known flaw.
Subtopics#
- Network file systems: SMB, NFS, and AFP, reached by mounting or protocol clients.
- Transfer protocols: FTP, FTPS, SFTP, TFTP, and rsync.
- Web file access: HTTP file servers, WebDAV, and managed file transfer appliances.