diff --git a/.gitbook/assets/Recycle_bin_filter-on-filename.png b/.gitbook/assets/Recycle_bin_filter-on-filename.png new file mode 100755 index 0000000..cd5ecb8 Binary files /dev/null and b/.gitbook/assets/Recycle_bin_filter-on-filename.png differ diff --git a/.gitbook/assets/Recycle_bin_listing-files.png b/.gitbook/assets/Recycle_bin_listing-files.png new file mode 100755 index 0000000..4a2e503 Binary files /dev/null and b/.gitbook/assets/Recycle_bin_listing-files.png differ diff --git a/SUMMARY.md b/SUMMARY.md index 1f0a63a..66ad99d 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -67,6 +67,7 @@ * [Process Injection (pi module)](smb-protocol/command-execution/execute-remote-command/process-injection-pi-module.md) * [Getting Shells 101](smb-protocol/command-execution/getting-shells-101.md) * [Spidering Shares](smb-protocol/spidering-shares.md) +* [Recycle Bin](smb-protocol/recycle-bin.md) * [Get and Put Files](smb-protocol/get-and-put-files.md) * [Obtaining Credentials](smb-protocol/obtaining-credentials/README.md) * [Dump SAM](smb-protocol/obtaining-credentials/dump-sam.md) diff --git a/smb-protocol/recycle-bin.md b/smb-protocol/recycle-bin.md new file mode 100644 index 0000000..7ac4bbd --- /dev/null +++ b/smb-protocol/recycle-bin.md @@ -0,0 +1,46 @@ +--- +description: List and download files in the Recycle Bin +--- + +# Recycle Bin Module + +{% hint style="warning" %} +This module requires administrator privileges. +{% endhint %} + +This module lists deleted files in the Recycle Bin for every user. It shows the original location/filename of the deleted file as well as the date when it was deleted. + +List files in the Recycle Bin on the remote target: + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin +``` + +

Listing Recycle Bin files

+ +List and download all files in the Recycle Bin on the remote target: + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin -o DOWNLOAD=true +``` + +List and download only specific files using a filter on the original name (file name) value: + +{% hint style="info" %} +The below command only downloads files that contain the word "pass" in their original filename. +{% endhint %} + +```bash +nxc smb 192.168.1.10 -u USER -p PASSWORD -M recyclebin -o DOWNLOAD=true FILTER=pass +``` + +

Download files with names that contain the word "pass"

+ +## Module Options + +```bash +DOWNLOAD Download the files in the Recycle Bin (default: False) + Example: -o DOWNLOAD=True +FILTER Filter what files you want to download (default: all) based on their original filename, supports regular expressions + Example: -o FILTER=pass +```