v1.0

snaffler.exe

By
Brian Johnson

snaffler absolutely rules and finding good SMB share treasures!

Spawn a "runas" box

You'll want to spawn a "runas" command window under the context of your test Active Directory account. Syntax for that is here.

General domain-wide snaffling

I like to set -x 5 to limit the amount of threads running at once.

snaffler.exe -s -d domain.com -c THE.DC.IP.ADDRESS -o snaffy.log -m DUMPFOLDER -x 5

General domain-wide snaffling (with JSON output)

Same command but specify something like -o snaffy.json and specify JSON type with the flag -t JSON:

snaffler.exe -s -d domain.com -c THE.DC.IP.ADDRESS -o snaffy.json -m DUMPFOLDER -t JSON -x 5

Trageted snaff of a list of machines

snaffler.exe -s -d domain.com -c THE.DC.IP.ADDRESS -o snaffy.json -m DUMPFOLDER -t JSON -x 5 -n .\pclist.txt

Targeted snaff of a specific machine share

snaffler -s -d domain.com -c IP-OF-DOMAIN-CONTROLLER -o snaffspecific.log -n SOME-SYSTEM -m folder-to-dump-files-to

Extract passwords and save to snaffpasswords.txt

grep -Po 'Password="\K[^"]+' snaffpass.txt | grep -Ev '^\{?Password\}?$|^\.\+\($' > snaffpasswords.txt

Extract full lines containing asplaintext (case-insensitive) and save to snaffasplaintext.txt

grep -i 'asplaintext' snaffpass.txt > snaffasplaintext.txt

File cleanup "loop" script

Sometimes you'll be humming along with a snaffler job when it will start gobbling TONS of little files (like .bak). You might not care about having these type of files copied locally, but your hard drive will care when it fills up! Here's a little script you can run from your snaffler dump folder to have it recursively purge specific file types. The script will let you configure file extension(s) and then check every 60 seconds to see how full the hard drive is. If the hard drive ever drops below 5GB, the purge runs.

$path = (Get-Location).Path

Write-Host ""
Write-Host "Starting directory:" -ForegroundColor Cyan
Write-Host "  $path"
Write-Host ""

$inputExtensions = Read-Host "Enter extensions to delete (comma-separated, e.g. bak,zip,dwg,7z)"

$extensions = $inputExtensions -split "," |
    ForEach-Object {
        $ext = $_.Trim()
        if ($ext -notmatch '^\*\.') {
            "*.$ext"
        }
        else {
            $ext
        }
    } |
    Where-Object { $_ -ne "*." }

Write-Host ""
Write-Host "You selected:" -ForegroundColor Yellow
Write-Host "  $($extensions -join ', ')"
Write-Host ""

$confirmation = Read-Host "Enter 'yes' to continue, or anything else to cancel"

if ($confirmation -ne "yes") {
    Write-Host "Cancelled." -ForegroundColor Red
    exit
}

Write-Host ""
Write-Host "Cleanup loop started. Checking every 60 seconds..." -ForegroundColor Green
Write-Host ""

while ($true) {
    $drive = Get-PSDrive -Name (Get-Location).Drive.Name

    if ($drive.Free -lt 5GB) {
        Write-Host ""
        Write-Host "Free space is below 5 GB. Deleting matching files..." -ForegroundColor Yellow

        Get-ChildItem -Path $path -File -Recurse -Include $extensions |
            ForEach-Object {
                Write-Host "Deleting $($_.FullName)"
                Remove-Item $_.FullName -Force
            }
    }
    else {
        Write-Host "Free space: $([math]::Round($drive.Free / 1GB, 2)) GB - nothing to delete."
    }

    Start-Sleep -Seconds 60
}