# T1021.002 - SMB/Windows Admin Shares
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1021/002)
<blockquote>Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Map admin share](#atomic-test-1---map-admin-share)

- [Atomic Test #2 - Map Admin Share PowerShell](#atomic-test-2---map-admin-share-powershell)

- [Atomic Test #3 - Copy and Execute File with PsExec](#atomic-test-3---copy-and-execute-file-with-psexec)

- [Atomic Test #4 - Execute command writing output to local Admin Share](#atomic-test-4---execute-command-writing-output-to-local-admin-share)


<br/>

## Atomic Test #1 - Map admin share
Connecting To Remote Shares

**Supported Platforms:** Windows


**auto_generated_guid:** 3386975b-367a-4fbb-9d77-4dcf3639ffd3





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | Username | String | DOMAIN&#92;Administrator|
| share_name | Examples C$, IPC$, Admin$ | String | C$|
| password | Password | String | P@ssw0rd1|
| computer_name | Target Computer Name | String | Target|


#### Attack Commands: Run with `command_prompt`! 


```cmd
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
```






<br/>
<br/>

## Atomic Test #2 - Map Admin Share PowerShell
Map Admin share utilizing PowerShell

**Supported Platforms:** Windows


**auto_generated_guid:** 514e9cd7-9207-4882-98b1-c8f791bae3c5





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| share_name | Examples C$, IPC$, Admin$ | String | C$|
| map_name | Mapped Drive Letter | String | g|
| computer_name | Target Computer Name | String | Target|


#### Attack Commands: Run with `powershell`! 


```powershell
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
```






<br/>
<br/>

## Atomic Test #3 - Copy and Execute File with PsExec
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).

**Supported Platforms:** Windows


**auto_generated_guid:** 0eb03d41-79e4-4393-8e57-6344856be1cf





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_path | File to copy and execute | Path | C:&#92;Windows&#92;System32&#92;cmd.exe|
| remote_host | Remote computer to receive the copy and execute the file | String | &#92;&#92;localhost|
| psexec_exe | Path to PsExec | string | C:&#92;PSTools&#92;PsExec.exe|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
#{psexec_exe} #{remote_host} -accepteula -c #{command_path}
```




#### Dependencies:  Run with `powershell`!
##### Description: PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe})
##### Check Prereq Commands:
```powershell
if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "$env:TEMP\PsTools.zip"
Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force
New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
Copy-Item $env:TEMP\PsTools\PsExec.exe "#{psexec_exe}" -Force
```




<br/>
<br/>

## Atomic Test #4 - Execute command writing output to local Admin Share
Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.

**Supported Platforms:** Windows


**auto_generated_guid:** d41aaab5-bdfe-431d-a3d5-c29e9136ff46





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Remote computer to receive the copy and execute the file | String | output.txt|
| command_to_execute | Command to execute for output. | String | hostname|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
```






<br/>
