# FindUncommonShares | Allowing To Quickly Find Uncommon Shares In Vast Windows Domains **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, freebies, networking\ **Created:** [March 26, 2023, 12:27am UTC](https://onehack.st/t/finduncommonshares-allowing-to-quickly-find-uncommon-shares-in-vast-windows-domains/234993 "2023-03-26T00:27:54Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [March 26, 2023, 12:27am UTC](https://onehack.st/t/finduncommonshares-allowing-to-quickly-find-uncommon-shares-in-vast-windows-domains/234993/1 "2023-03-26T00:27:54Z")
![image](https://onehack.st/uploads/default/original/3X/d/7/d77359a666f54cf4317c976c896c5b3ea75a3846.png) [![](https://github.com/p0dalirius/FindUncommonShares/raw/main/.github/banner.png)](https://github.com/p0dalirius/FindUncommonShares/blob/main/.github/banner.png) The script [FindUncommonShares.py](https://github.com/p0dalirius/FindUncommonShares/blob/main/FindUncommonShares.py) is a Python equivalent of [PowerView](https://github.com/darkoperator/Veil-PowerView/)’s [Invoke-ShareFinder.ps1](https://github.com/darkoperator/Veil-PowerView/blob/master/PowerView/functions/Invoke-ShareFinder.ps1) allowing to quickly find uncommon shares in vast Windows Active Directory Domains. [![GitHub release (latest by date)](https://camo.githubusercontent.com/c78b56d6252509eda38334319df431b572bf3b2ca4f096ca7dc84e909e3564e7/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f46696e64556e636f6d6d6f6e536861726573)](https://camo.githubusercontent.com/c78b56d6252509eda38334319df431b572bf3b2ca4f096ca7dc84e909e3564e7/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f46696e64556e636f6d6d6f6e536861726573) [![](https://camo.githubusercontent.com/b10eb64ea9c513e01a8f68ba2f60cab855d32eace20c7a0de41f4d0df41394da/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f706f64616c69726975735f3f6c6162656c3d506f64616c6972697573267374796c653d736f6369616c)](https://twitter.com/intent/follow?screen_name=podalirius_) [![YouTube Channel Subscribers](https://camo.githubusercontent.com/ba5ae186e8603121f9a0c6485c5d220b579b4653c0017a2b84320a6e87839d92/68747470733a2f2f696d672e736869656c64732e696f2f796f75747562652f6368616e6e656c2f73756273637269626572732f5543465f78354f3743536672383241664e56544b4f765f413f7374796c653d736f6369616c)](https://www.youtube.com/c/Podalirius_?sub_confirmation=1) ## Features - Only requires a **low privileges domain user account**. - Automatically gets the list of all computers from the domain controller’s LDAP. - Ignore the hidden shares (ending with `$`) with `--ignore-hidden-shares`. - Multithreaded connections to discover SMB shares. - Export results in JSON with IP, name, comment, flags and UNC path with `--export-json `. - Export results in XLSX with IP, name, comment, flags and UNC path with `--export-xlsx `. - Export results in SQLITE3 with IP, name, comment, flags and UNC path with `--export-sqlite `. - Iterate on LDAP result pages to get every computer of the domain, no matter the size. ## Usage ```auto $ ./FindUncommonShares.py -h FindUncommonShares v2.5 - by @podalirius_ usage: FindUncommonShares.py [-h] [--use-ldaps] [-q] [--debug] [-no-colors] [-I] [-t THREADS] [--export-xlsx EXPORT_XLSX] [--export-json EXPORT_JSON] [--export-sqlite EXPORT_SQLITE] --dc-ip ip address [-d DOMAIN] [-u USER] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key] [-k] Find uncommon SMB shares on remote machines. optional arguments: -h, --help show this help message and exit --use-ldaps Use LDAPS instead of LDAP -q, --quiet Show no information at all. --debug Debug mode. -no-colors Disables colored output mode -I, --ignore-hidden-shares Ignores hidden shares (shares ending with $) -t THREADS, --threads THREADS Number of threads (default: 20) Output files: --export-xlsx EXPORT_XLSX Output XLSX file to store the results in. --export-json EXPORT_JSON Output JSON file to store the results in. --export-sqlite EXPORT_SQLITE Output SQLITE3 file to store the results in. Authentication & connection: --dc-ip ip address IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameter -d DOMAIN, --domain DOMAIN (FQDN) domain to authenticate to -u USER, --user USER user to authenticate with Credentials: --no-pass Don't ask for password (useful for -k) -p PASSWORD, --password PASSWORD Password to authenticate with -H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH NT/LM hashes, format is LMhash:NThash --aes-key hex key AES key to use for Kerberos Authentication (128 or 256 bits) -k, --kerberos Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line ``` ## Examples : ```auto $ ./FindUncommonShares.py -u 'user1' -d 'LAB.local' -p 'P@ssw0rd!' --dc-ip 192.168.2.1 FindUncommonShares v2.5 - by @podalirius_ [>] Extracting all computers ... [+] Found 2 computers. [>] Enumerating shares ... [>] Found 'Users' on 'DC01.LAB.local' [>] Found 'WeirdShare' on 'DC01.LAB.local' (comment: 'Test comment') [>] Found 'AnotherShare' on 'PC01.LAB.local' [>] Found 'Users' on 'PC01.LAB.local $ ``` Each JSON entry looks like this: { “computer”: { “fqdn”: “DC01.LAB.local”, “ip”: “192.168.1.1” }, “share”: { “name”: “ADMIN$”, “comment”: “Remote Admin”, “hidden”: true, “uncpath”: “\\192.168.1.46\ADMIN$\”, “type”: { “stype\_value”: 2147483648, “stype\_flags”: [“STYPE\_DISKTREE”, “STYPE\_TEMPORARY”] } } } ## Demonstration [![](https://github.com/p0dalirius/FindUncommonShares/raw/main/.github/example.png)](https://github.com/p0dalirius/FindUncommonShares/blob/main/.github/example.png) ## GitHub: [https://github.com/p0dalirius/FindUncommonShares](https://github.com/p0dalirius/FindUncommonShares)