From an existing foothold inside a lower-trust zone, enumerate SMB shares on an in-scope Windows host in a higher-trust zone and use a valid account with remote administrative rights to attempt command execution over SMB. This tests whether network reachability and account permissions cross the intended security boundary; share enumeration or credential recovery alone does not establish remote execution.
Requirements: none specified (operational prerequisites may still apply)
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
CrackMapExec · SMB share enumeration
SMB share enumeration
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER