PASSWORD ATTACKS : Credential Hunting in Network Shares

HTB Academy

In this guide, we’ll walk through a powerful technique using NetExec (nxc) and its spider_plus module to automate this process, recursively searching for and downloading files from accessible SMB shares.

While exploring options for this task, I found that tools like PowerHuntShares often didn't provide the necessary detailed information or comprehensive recursive scanning I needed. This led me to NetExec (nxc), a more robust and versatile solution. In this guide, we'll walk through a powerful technique using NetExec and its spider_plus module to automate this process, recursively searching for and downloading files from accessible SMB shares.

Step 1: Initiating the Spider_Plus Scan

The core of this technique lies in the spider_plus module. This module is designed to recursively find all accessible files and folders on shared drives and, optionally, download them.

Here’s the command we’ll use:

Bash

nxc smb <Target Ip> -u mendres -p Inlanefreight2025! -M spider_plus -o DOWNLOAD_FLAG=True --smb-timeout 60

Let’s break down what each part of this command does:

• **nxc smb <Target Ip>**: This specifies that we're using NetExec to connect to a target Windows machine (at <Target Ip>) via its SMB (file sharing) service.
• **-u mendres -p Inlanefreight2025!: We're authenticating to the SMB share using the username mendres and the password Inlanefreight2025!. Remember to replace these with your actual target credentials.**
• **-M spider_plus**: This tells NetExec to execute the spider_plus module.
• **-o DOWNLOAD_FLAG=True**: This crucial option instructs spider_plus to download all found files to our local machine. This is incredibly useful for offline analysis.
• **--smb-timeout 60**: We're setting a 60-second timeout for SMB operations. This can be adjusted based on network conditions and target responsiveness.

Patience is Key! This process can take a significant amount of time, especially on targets with large file systems. Hold still and let NetExec do its work.

Step 2: Navigating to the Downloaded Files

Once the spider_plus scan is complete, NetExec will have created a subdirectory containing all the downloaded files. This directory is conveniently named after the target IP address.

To access these files, navigate to the following directory:

Bash

cd /tmp/nxc_hosted/nxc_spider_plus/<target-IP>

Note: Replace <target-IP> with the actual IP address of your target machine.

Step 3: Starting Your Credential Hunt!

Now that you have a local copy of the target’s SMB shares, it’s time to start digging for sensitive information, particularly credentials. A common way to do this is by searching for keywords like “password.”

We’ll use the grep command for a powerful and recursive search:

Bash

grep -ri "passw" .

Here’s a breakdown of this grep command:

• **grep**: The command-line utility for searching plain-text data sets for lines that match a regular expression.
• **-r (recursive)**: This option tells grep to search directories recursively.
• **-i (ignore case)**: This makes the search case-insensitive, so it will match "password", "Password", "PASSW", etc.
• **"passw"**: The pattern we are searching for. We're using "passw" to catch variations like "password," "passwords," or "passwd."
• **.**: This specifies that the search should be conducted in the current directory (which is your <target-IP> download directory) and its subdirectories.

Finding the First Credential

Using the above grep command, you might find something similar to this:

./IT/Tools/split_tunnel.txt:# Auth backup password: INLANEFREIGHT\jbader:*

Bingo! This looks like a set of credentials for the user jbader.

Step 4: Iterating with New Credentials

The beauty of this method is its iterative nature. Once you find new credentials, you can repeat the entire process, using the newly discovered credentials to potentially access more shares or escalate privileges.

For the second question in your scenario, you’ll repeat the same nxc smb command, but this time using the jbadercredentials you just found.

Hint for the Second Credential

The second credential, in this specific scenario, is located in:

./HR/Confidential/Onboarding_Docs_132.txt

Keep hunting, and happy pivoting!

Troubleshooting Common Pitfalls: The Manspider Memory Issue

During my reconnaissance, I encountered a significant hurdle while attempting to use MANSPIDER for similar purposes. It's a common issue that can plague tools reliant on heavy compilation processes, especially within virtualized environments.

The Problem: The extractous package, a critical dependency of MANSPIDER, isn't a straightforward Rust package. It leverages GraalVM Native Image to compile Java code (specifically, Apache Tika, which extractous wraps) into a native shared library.

Compiling with GraalVM Native Image is extremely memory-intensive. I repeatedly faced the error “The Native Image build process ran out of memory,” accompanied by an exit code 137. An exit code of 137 is a classic indicator that the Out-of-Memory (OOM) killer terminated the process, confirming a severe lack of available RAM.

This issue was particularly prevalent as my Parrot OS was running within a UTM virtual machine. Virtual machines, by default, often allocate minimal memory unless explicitly configured otherwise. extractous's build process itself suggested needing "2.89GB of memory (75.6% of 3.82GB system memory, determined at start)." This meant it attempted to consume nearly 3GB of RAM from a VM with only about 3.8GB allocated, which simply wasn't sufficient for the compilation to complete successfully.

The Solution: The resolution was to increase the RAM allocated to my Parrot OS VM in UTM. By providing the virtual machine with ample memory, the extractous compilation could proceed without being terminated by the OOM killer, allowing MANSPIDER to function as intended. This highlights a crucial point for anyone running memory-intensive tools in virtualized environments: always ensure your VM has sufficient resources.

Connect me:

https://www.linkedin.com/in/sau-rav-18350b260/