id: smb-shares

info:
  name: SMB Shares - Enumeration
  author: pussycat0x
  severity: low
  description: |
    Attempts to list shares using the srvsvc.NetShareEnumAll MSRPC function and retrieve more information about them using srvsvc.NetShareGetInfo. If access to those functions is denied, a list of common share names are checked.
  reference:
    - https://nmap.org/nsedoc/scripts/smb-enum-shares.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: port:445
  tags: js,network,smb,enum,auth

javascript:
  - pre-condition: |
      isPortOpen(Host, Port);

    code: |
      try {
          var smb = require("nuclei/smb");
          var client = smb.SMBClient();

          var shares = client.ListShares(Host, Port, User, Pass);

          if (shares && shares.length > 0) {
              Export(shares);
          } else {
              Export([]);
          }
      } catch (e) {
          Export([]);
      }

    args:
      Host: "{{Host}}"
      Port: "445"
      User: "{{username}}"
      Pass: "{{password}}"

    attack: clusterbomb
    threads: 1
    stop-at-first-match: true

    payloads:
      username:
        - ""
        - administrator
        - admin
        - guest

      password:
        - ""
        - administrator
        - admin
        - password
        - guest

    matchers:
      - type: dsl
        dsl:
          - success == true
          - response != "[]"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 4b0a00483046022100e841dcb39531a29149cdef2b76ac5ae7dcd08253b9e122780e1c2180f030e062022100f4320fa42459105f809991e4e0dd80b30f834123ba4e40b1bc9a29e932c5817f:922c64590222798bb761d5b6d8e72950