Write access to a share is far more than the ability to store files: it is a way to get code executed and credentials captured when other users or systems interact with the share. Three techniques follow. Planting executables or DLLs where an application or user will run them gives code execution in that context. Poisoning Office documents and their templates runs macros or external references when a user opens them. And dropping SCF or LNK files whose icon or target points at an attacker host forces the viewer's machine to authenticate there as soon as the folder is browsed, capturing or relaying the credential. The common thread is that write access converts normal use of the share into attacker advantage.
# confirm writable, then plant (null/guest/creds per the enumeration)
smbclient //<target>/<share> -U 'user%pass' -c 'put payload'
nxc smb <target> -u user -p 'pass' --shares # WRITE flag confirms the target
Subtopics#
- Executable and DLL planting: getting planted code run.
- Office and template poisoning: macro and template execution on open.
- SCF and LNK coercion: forcing authentication on folder browse.