Skip to content
HackIndex logo

HackIndex

Administrative SMB Share Exposure

2 min read May 15, 2026

Administrative shares are normal on Windows. The finding is when credentials that should not have administrative file access can reach them, because that usually means the account already crosses an important privilege boundary and may support remote management or follow-on execution paths.

Start with authenticated share discovery.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u "$USER" -p "$PASSWORD" --shares
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -U "$USER%$PASSWORD"

The shares that matter most are C$, ADMIN$, and IPC$.

Test whether access is real.

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/C$ -U "$USER%$PASSWORD" -c "dir"
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/ADMIN$ -U "$USER%$PASSWORD" -c "dir"

If only IPC$ is reachable, that is usually less important than filesystem access. If C$ or ADMIN$ works for a user that should be low-privileged, raise it immediately. Access to those shares can expose the full filesystem, Windows directories, service-related files, scripts, and operational data, and it often means the account has more privilege than intended. Confirmed admin share access leads to Pass-the-Hash over SMB and AD Remote Execution.

If the same credential reaches administrative shares on multiple hosts, this is broader than a one-host issue. It points to a recurring privilege boundary failure, not a local exception.

References