Skip to content

Add shares-plus module: recursive share permission enumeration#1189

Closed
mHijuxS wants to merge 4 commits into
Pennyw0rth:mainfrom
mHijuxS:shares-plus
Closed

Add shares-plus module: recursive share permission enumeration#1189
mHijuxS wants to merge 4 commits into
Pennyw0rth:mainfrom
mHijuxS:shares-plus

Conversation

@mHijuxS
Copy link
Copy Markdown

@mHijuxS mHijuxS commented Apr 6, 2026

Description

Adds a new shares-plus SMB module that recursively enumerates share permissions on a per-directory basis. Unlike spider_plus (which focuses on file inventory and download), this module maps READ/WRITE access at every directory level to identify ACL boundaries and writable drop paths.

Key features:

  • Recursive directory crawling with configurable DEPTH limit
  • Per-directory write checks (creates + deletes a temp directory)
  • Delta mode: only highlights directories where permissions differ from their parent
  • File listing with human-readable sizes
  • Summary of all writable subdirectories at the end
  • Configurable share/folder exclusions
  • Auto-reconnect on connection drops

This PR was created with the assistance of AI (Claude Code - used for planning, implementing, linting, e2e test generation, and PR readiness).

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

  • Any SMB target with accessible shares (tested against Windows Server 2019 Build 17763 DC with multiple shares and nested directories with varying ACLs)
  • No additional software or configuration needed beyond a standard NetExec install

Usage examples:
nxc smb -u -p -M shares-plus
nxc smb -u -p -M shares-plus -o DEPTH=5 DELTA=True WRITE_CHECK=True FILES=False

Module options:

Option Default Description
DEPTH 3 Max recursion depth (0 = unlimited)
EXCLUDE print$,ipc$ Comma-separated shares/folders to skip
DELTA True Only show dirs where perms differ from parent
WRITE_CHECK True Test write permission per directory
FILES True Show files in each directory

Screenshots

image

Checklist:

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

railcoa and others added 4 commits April 6, 2026 03:49
Crawls SMB shares recursively showing per-directory READ/WRITE
permissions and file listings. Catches NTFS ACL differences that
--shares misses by only testing share root level.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@NeffIsBack
Copy link
Copy Markdown
Member

Closing as per our AI policy: https://github.com/Pennyw0rth/NetExec/blob/main/AI_POLICY.md

Also duplicate to #1188, see #1188 (comment)

@NeffIsBack NeffIsBack closed this Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants