[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Shares as entry points

Posted on 2012-03-28
3
Medium Priority
?
340 Views
Last Modified: 2012-03-29
I found http://technet.microsoft.com/en-us/library/cc526440.aspx

And it says


"Remove All Unnecessary File Shares
Remove all unnecessary file shares on the system to prevent possible information disclosure and to prevent malicious users from using the shares as an entry to the local system"

I am aware that shares can be "shared" to groups like everyone/domain users etc and ift theres senstivie data resident then that can be accessed.

But it hints at shares as an entry point:


"from using the shares as an entry to the local system"

To perhaps gain access to admin areas of the system?

So is that possible, or theoretical? A non admin share shared to the everyone group could actually open up the server to compromise so the user can get access to the admin area of the server?
0
Comment
Question by:pma111
  • 2
3 Comments
 
LVL 5

Accepted Solution

by:
9660kel earned 2000 total points
ID: 37776104
It's possible, but it would require access to the server, (authenticated user) and some fairly sophisticated understanding of the file system and some fancy command line and batch files.

Not very likely, but it's generally better to assign permissions to groups than just everyone. Also, just because they have access to the share, doesn't mean they have any permissions to the folders and files contained in the share, that's separate. (the security tab)

For general access, I use the domain users group.
0
 
LVL 3

Author Comment

by:pma111
ID: 37776120
Ok thanks for the reply

When you say "access to the server", hwo do you mean. SAy for example

\\server\share\dir\file.xls (shared to everyone - so a random user navigates to that file/folder), does that quantify as access to the server?
0
 
LVL 5

Expert Comment

by:9660kel
ID: 37776140
They would need a user account that has access to the share. Essentially it COULD make it easier to escalate privileges on the server, although with the type of skills needed, they could probably do that anyway, it just leaves fewer doors open to use the domain users group.

Really the main problem with open shares is virus infections spreading via the share.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Experts Exchange expands question security options for members.
Securing your business data in current era should be your biggest priority. Numerous people are unaware of the fact that insiders commit more than 60 percent of security breaches. You need to figure out the underlying cause and invoke your potential…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question