Finding open file shares where users gave rights to Everyone

Hi all,
I’m looking for a better way to scan a network for open file shares (SMB, as in Windows file sharing and Samba). At the University where I work a lot of professors and staff know little about computers and when there share out part of their hard drives they end up giving read write access to everyone. I do audits for IT and was looking for a better way to do searches for overly permissive shares. Currently I use Legion to look for all shares in an IP range then check rights by hand. Does anyone know of a tool that lets you do what Legion does, but also reports back the NetBIOs name and the file share rights all in one report? I’ve been working on scripting one but it’s not going as well as I would like.

GFI's Languard networkscanner.

for windows .. I used to use a program called nbtdump.exe (its been ages tho) it will give you all the shares open on a machine .. all the user accounts etc and even check to see if they have a blank password ... or at least it did 4 years ago :) ... its still a good little proggy .. takes up hardly any room and you run it from a command prompt :)

Softperfect Netscanner - I'm not sure where i found this app, but I have it here. It is quite fun, and will scan *any* IP ranges for shares and other such things.

It's a single EXE in a ZIP.

Not sure of a good one but check www.blackcode.com and you can probably find one that you will like there.

GFI Languard is one of the ones I use in addition to the share scanning it will also check what patches are missing from windows and can push them down to the machines. Has a lot of other great features also.

You are right, LANguard is nice. Too bad it's not free, I don't exactly have a buget. The Softperfect Netscanner seems to do some what close to my needs, I just wish it gave as much info about permissions as LANGuard.

IronGeek -

Here is a site that you can most likely find something you need.

http://www.zone-h.org/en/download/category=28/

I hope this helps.

- MilitantEidolon

languard has a trial of 30 days, for the rest it is fully functional, so you could use it at least for 30 days...

I know, thats what I have been doing. Maybe I can get IT on campus to spring for it.

Irongeek:
Check out SHED by Robin Keir...and it's FREE.

You can scan as many subnets at a time too! Great tool.

http://www.keir.net/shed.html

I just gave Shed a try and it does not seem to give any information about permissions. It also seems a bit flaky when I scanned a know host with shares and it came up with nothing. Thanks for pointing it out though.

Quote:

---

Originally posted here by Irongeek
I just gave Shed a try and it does not seem to give any information about permissions. It also seems a bit flaky when I scanned a know host with shares and it came up with nothing. Thanks for pointing it out though.

---

Oh, you know what? I think that it requires Null session to be open, allowing anonymous connections to the IPC$ share. If you set turn this off, using RestrictAnonymous key set to 1 or 2, it wont work. XP may have this turned off by default.

I just looked into this and had forgotten about this. Sorry about that.

If you're stuck with your script you could use the resource kit utility SHOWACLS and grep through it. If I had to solve your problem using a script I would use Perl.

If I run across anything I'll let you know. Good luck.

This is my second post about a utility from Sysinternals, you guys are going to start to think I work for them :D

Quote:

---

An aspect of Windows NT/2000/XP network security that's often overlooked is file shares. A common security flaw occurs when users define file shares with lax security, allowing unauthorized users to see sensitive files. There are no built-in tools to list shares viewable on a network and their security settings, but ShareEnum fills the void and allows you to lock down file shares in your network.

---

This tool might be what your looking for Irongeek.

Cheers:

there are free p2p sharing programs on CNET that autodetects the Windows shares and compiles them from a given range of ip'sthat you specify...Sort of a combo scanner/p2p browser.....

DjM: ShareEnum looks like just want I want, but I'll have to find a way to make it work with IP ranges instead of Domains/Workgroups.

Icefyre24: Can you give me a name?

Thanks guys.

Quote:

---

Originally posted here by Irongeek
DjM: ShareEnum looks like just want I want, but I'll have to find a way to make it work with IP ranges instead of Domains/Workgroups.

---

Well the source is available at the same link, you might be able to code it yourself, or maybe someone else on AO can give you a hand (my programming sucks :rolleyes: )


Cheers:

My C++ is rusty, but I'll see what I can do.

I took a look at the code and I have to admit that it's a little beyond me.

Quote:

---

Originally posted here by Irongeek
I took a look at the code and I have to admit that it's a little beyond me.

---

I know there are some pretty good code pounders here at AO, I am sure one of them would be up to the challenge......so who's it going to be gang? :p

Cheers:

Ive been very succesful with a small batch file, although im not sure how it would perform. quite simple to construct using ping and net use and a for loop to scan teh ip range.

dunno whether that would work for you...

i2c

It would work for me, if it also list permissions.

Quote:

---

Originally posted here by Irongeek
It would work for me, if it also list permissions.

---

Take i2c's script and add resource kit utility SHOWACLS to it. The challenge might be pulling the computer names from the output of his net use but sounds like you have enough programming knowledge to do this.

i2c , mind posting your script when you get a chance? Thanks

yep I will its on my other computer so ill have to get it later, it doesnt list permission but that should be easy enough to put in.

i2c