Skip to content
HackIndex.io

Administrative SMB Share Exposure

3 min read Created Mar 6, 2026 Last updated Aug 11, 2026

Administrative shares are normal on Windows. Every host exposes C$, ADMIN$, and IPC$ by default. The finding is when credentials that lack administrative intent can reach them. That usually means the account crosses a privilege boundary it should not cross. Access to admin shares often enables remote management and follow-on execution paths. Service accounts, developer accounts, and backup accounts commonly carry these rights unintentionally. Start with authenticated share discovery.

Detecting SMB Admin Shares Exposure

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u "$USER" -p "$PASSWORD" --shares
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -U "$USER%$PASSWORD"

The shares that matter most are C$, ADMIN$, and IPC$. nxc marks READ and WRITE access separately in its output. smbmap shows a permission column per share. A READ result on C$ or ADMIN$ is already significant. WRITE access means you can place files, which opens staging and persistence paths. Test whether access is real by connecting and listing directory contents.

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/C$ -U "$USER%$PASSWORD" -c "dir"
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/ADMIN$ -U "$USER%$PASSWORD" -c "dir"

If only IPC$ is reachable, that is usually less important than filesystem access. IPC$ enables named pipe communication and RPC calls. It matters for other checks but does not give file access. If C$ or ADMIN$ works for a user that should be low-privileged, raise it immediately. Access to those shares exposes the full filesystem and Windows directories. Look for credential files, configuration files with embedded passwords, scheduled task scripts, and deployment artifacts.

High-value locations to check on admin shares:

  • C:\Users profiles for saved credentials and SSH keys
  • C:\Windows\Temp for dropped tools and artifacts
  • C:\inetpub for web.config files with connection strings
  • C:\Windows\NTDS on DCs for directory database backups

User profiles under C:\Users and C:\Windows\Temp are common locations. Confirmed admin share access leads to Pass-the-Hash over SMB and AD Remote Execution.

UAC remote restrictions can block access even when the account is in the local Administrators group. This applies to non-RID-500 local accounts on the target. Domain accounts and the built-in local Administrator (RID 500) bypass UAC remote filtering by default. If access fails for a local account that should have rights, UAC filtering is the likely cause.

If the same credential reaches administrative shares on multiple hosts, this is broader than a one-host issue. It points to a recurring privilege boundary failure, not a local exception. Document every host where the credential lands. Treat it as a credential reuse finding alongside the share exposure.

References