Class SMBSharesManager

validators/smb_shares_manager.py:18–549

Comprehensive SMB shares management class

logger = logging.getLogger('NetworkHound.SMBSharesManager')

class SMBSharesManager:
    """Comprehensive SMB shares management class"""
    
    def __init__(self, timeout=5, max_threads=10, use_multiprocessing=False):
        self.timeout = timeout
        self.max_threads = max_threads
        # Multiprocessing disabled - always use threading for stability
        self.use_multiprocessing = False
        
    def discover_smb_shares(self, ip, port, username="", password="", domain="", ntlm_hash="", kerberos_ticket=""):
        """Discover SMB shares on a specific IP:port"""
        results = {
            'smb': {
                'status': False, 
                'version': None, 
                'shares': [], 
                'domain': None,
                'server_name': None,
                'os': None,
                'error': None,
                'auth_required': False,
                'guest_access': False,
                'accessible_shares': []
            }
        }
        
        # Only test SMB ports
        if port not in [139, 445]:
            results['smb']['error'] = f"Port {port} is not an SMB port"
            return results
        
        try:
            # For Kerberos authentication, try to resolve IP to hostname for proper SPN
            target_name = ip
            if kerberos_ticket:
                # Try common hostname patterns for domain controllers
                potential_hostnames = [
                    f"dc01.{domain}",
                    f"dc.{domain}",
                    f"dc1.{domain}",
                    f"hst1.{domain}",
                    f"hst2.{domain}",
                    f"hst3.{domain}",
                    f"host1.{domain}",
                    f"host2.{domain}",
                    f"host3.{domain}",
                    f"server.{domain}",
                    f"server1.{domain}",
                    f"server2.{domain}"
                ]
                
                import socket
                hostname_found = False
                
                # Try common DC hostnames first (more reliable than reverse DNS)
                for potential_hostname in potential_hostnames:
                    try:
                        resolved_ip = socket.gethostbyname(potential_hostname)