diff --git a/.gitbook/assets/Recycle_bin_filter-on-filename.png b/.gitbook/assets/Recycle_bin_filter-on-filename.png new file mode 100644 index 0000000..d79304f Binary files /dev/null and b/.gitbook/assets/Recycle_bin_filter-on-filename.png differ diff --git a/.gitbook/assets/Recycle_bin_listing-files.png b/.gitbook/assets/Recycle_bin_listing-files.png new file mode 100644 index 0000000..d773372 Binary files /dev/null and b/.gitbook/assets/Recycle_bin_listing-files.png differ diff --git a/SUMMARY.md b/SUMMARY.md index f7fb7ce..103bddb 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -69,6 +69,7 @@ * [Process Injection (pi module)](smb-protocol/command-execution/execute-remote-command/process-injection-pi-module.md) * [Getting Shells 101](smb-protocol/command-execution/getting-shells-101.md) * [Spidering Shares](smb-protocol/spidering-shares.md) +* [Recycle Bin](smb-protocol/recycle-bin.md) * [Get and Put Files](smb-protocol/get-and-put-files.md) * [Obtaining Credentials](smb-protocol/obtaining-credentials/README.md) * [Dump SAM](smb-protocol/obtaining-credentials/dump-sam.md) diff --git a/smb-protocol/recycle-bin.md b/smb-protocol/recycle-bin.md new file mode 100644 index 0000000..6b50f83 --- /dev/null +++ b/smb-protocol/recycle-bin.md @@ -0,0 +1,46 @@ +--- +description: List and download files in the Recycle Bin +--- + +# Recycle Bin Module + +{% hint style="warning" %} +This module requires administrator privileges. +{% endhint %} + +This module lists deleted files in the Recycle Bin for every user. It shows the original location, filename and size of the deleted file as well as the date when it was deleted. + +List files in all the Recycle Bins on the remote target: + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin +``` + +

Listing Recycle Bin files

+ +List and download all files in all Recycle Bins on the remote target: + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin -o DOWNLOAD=true +``` + +List and download only specific files using a filter on the original name (filename) value: + +{% hint style="info" %} +The below command only downloads files that contain the word "pass" in their original filename. +{% endhint %} + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin -o DOWNLOAD=true FILTER=pass +``` + +

Download files with names that contain the word "alice-passwords"

+ +## Module Options + +```bash +DOWNLOAD Download the files in the Recycle Bin (default: False) + Example: -o DOWNLOAD=True +FILTER Filter what files you want to download (default: all) based on their original filename, supports regular expressions + Example: -o FILTER=pass +```