n shares

Network storage, SMB/Samba shares, permissions & remote mounts

Usage — n shares

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — shares (sh, smb, nfs) — SMB/NFS shares, permissions, remote mounts & UAC status
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n sh .                               audit storage sharing on this machine

Target: . = this machine · <host> = remote
Deeper: n sh -h = the concept/theory behind this command  ·  n -h uac-shares

The concept behind it — n shares -h

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — Network Storage, SMB Shares & Remote Mounts ('n shares')
═══════════════════════════════════════════════════════════════════════════════

SHARES & STORAGE COMMANDS:
  n shares, sh            Audit all hosted shares, permissions, remote mounts & UAC status
  n sys                   Full system & hardware inventory (includes network shares table)

THE 2 BIGGEST WINDOWS SHARE TRAPS (EXPLAINED):

  1. THE UAC EXPLORER VISIBILITY TRAP (EnableLinkedConnections):
     • Under Windows UAC, an admin user gets TWO separate token sessions:
       - Standard Token: Used by Windows Explorer, web browsers, and desktop apps.
       - Elevated Token: Used by "Run as Administrator" PowerShell/CMD and installers.
     • Drive mappings (e.g. Z:) are stored per Logon Session (LUID), NOT globally!
     • If you map Z: in an elevated console, it is completely invisible in Windows Explorer!
     • Conversely, if mapped in Explorer, elevated backup scripts/installers cannot see Z:.
     • The Fix: Set the DWORD registry value EnableLinkedConnections = 1 in
       HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
       This tells the Windows kernel to mirror mapped drives across both tokens!

  2. SHARE PERMISSIONS VS. NTFS PERMISSIONS TRAP:
     • Every Windows share has TWO layers of security:
       - SMB Share Access (Get-SmbShareAccess): e.g. "Everyone: Full Control"
       - NTFS Directory ACLs (ICACLS / NTFS permissions on disk)
     • Windows enforces: The most restrictive permission wins!
     • If you grant "Everyone Full Control" on the share, but the underlying disk folder
       only grants "Users: Read", remote users CANNOT write or save files!

LINUX MOUNTS & SAMBA EXPORTS:
  • Remote CIFS/SMB, NFS, and SSHFS mounts are parsed from /proc/mounts.
  • Local Samba shares and access rules are audited from /etc/samba/smb.conf.
  • Active NFS exports and subnet permissions are audited from /etc/exports.