Sharefinder

Finding hidden fileshares could be a tedious task, especially evaluating the content. One way is to automate this with powershell, but the functions may be privileged or you may have no access to powershell. Another way is to use net view inside some scripts.

The sharefinder.cmd script below writes to a file of choice the contents of each file share on a server whether hidden or not.

Sharefinder assesses one server at a time while shareloop.cmd uses the sharefinder.cmd to loop through a list of servers. Thus, if you have a list of servers, use shareloop.

Finally, sharemapper.cmd uses mklink to map the folders into a directory of choice that you were able to list with sharefinder. Now you can just browse to this folder or CD into it and perform any type of search of choice across all file shares – whether its dir /s, findstr or any external tool such as filelocator ( https://www.mythicsoft.com/filelocatorlite/download/ ) to search for contents within all files. This is an alternative way for identifying passwords or sensitive information within files, that is likely undetected or flagged malicious since normal windows tools are used.

sharefinder.cmd

@echo off
echo “ShareFinder by K.Jansson 2020”
echo “Usage: %0 <hostname> <resultFile>”
echo “E.g. %0 \server1 H:\sf_result.txt”
echo ## %1 as of %date% ## >> %2
net view %1 /all | for /f “tokens=1” %%a in (‘findstr Disk’) do echo — %1\%%a — >> %2 & dir %1\%%a >> %2
echo —————— Contents of %2 ———————–
type %2

shareloop.cmd

@echo off
echo “shareloop by Kenny Jansson 2020”
echo “requires sharefinder.cmd”
echo “serverlist should contain name of server or IP per line without \\”
echo “usage: <serverList> <resultFile>”
echo e.g.: %0 serverlist.txt h:\sl_result.txt
for /f %%a in (%1) do (
sharefinder.cmd \%%a %2
)

echo —————— Contents of %2 ———————–
type %2

sharemapper.cmd
@echo off
echo “ShareMapper by K.Jansson 2020”
echo “Usage: %0 <resultFile> <linksFolderOfChoice> “
echo “E.g. %0 sf_result c:\temp\links”
echo “”
mkdir %2
type %1 | findstr Directory | for /f “tokens=3” %%a in (‘findstr of’) do (
echo Mapping: %%~Na
mkdir %2\%%a
rmdir %2\%%a
mklink /d %2\%%a %%a
)