FindUncommonShares for Windows SMB Share Discovery

FindUncommonShares is a Python-based security reconnaissance tool that discovers uncommon Server Message Block (SMB) shares across large Windows Active Directory domains. It provides functionality similar to PowerView’s Invoke-ShareFinder.ps1, helping security teams identify shared folders that may expose sensitive information or have unintended access permissions.

The tool queries Active Directory through LDAP to identify domain computers, then enumerates their SMB shares using multithreaded connections. It supports structured exports, making the results easier to review, investigate, and document during an authorized security assessment.

Key Features of FindUncommonShares

• Low-privilege authentication: A domain user account can be sufficient to begin enumeration, depending on the domain’s configuration and access restrictions.
• Automatic computer discovery: Retrieves computer information from the domain controller through LDAP.
• Multithreaded enumeration: Uses concurrent connections to inspect SMB shares across multiple machines.
• Hidden-share filtering: The --ignore-hidden-shares option excludes shares whose names end in $.
• Large-domain support: LDAP pagination helps retrieve computer records across large directory environments.
• Multiple export formats: Saves results as JSON, Excel XLSX, or SQLite databases for further analysis.
• Share details: Records information such as the computer name, IP address, share name, comment, type flags, and UNC path.

How to Install FindUncommonShares

Start by cloning the official repository onto a system with Python and network access to the authorized Windows domain. Review the project’s README for its current dependencies and installation instructions.

git clone https://github.com/p0dalirius/pyFindUncommonShares.git
cd pyFindUncommonShares

Install the dependencies specified by the project. Using a virtual environment helps keep them separate from other Python applications.

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install -r requirements.txt

On Windows, activate the environment with .venv\Scripts\activate. Run the help command to check the options supported by the version you installed.

python3 FindUncommonShares.py -h

Enumerating SMB Shares in a Windows Domain

FindUncommonShares accepts domain authentication details and the domain controller’s IP address. The following example uses the command-line syntax documented in the supplied version of the tool. Replace the example values with those for your authorized lab or assessment environment.

./FindUncommonShares.py \
  -u 'audituser' \
  -d 'LAB.local' \
  --dc-ip 192.168.2.1

The tool first discovers computers through LDAP and then attempts to enumerate their SMB shares. Results can include standard administrative shares and less familiar names, such as a custom share created for testing or departmental file storage.

To exclude hidden shares from the results, add the relevant option:

./FindUncommonShares.py \
  -u 'audituser' \
  -d 'LAB.local' \
  --dc-ip 192.168.2.1 \
  --ignore-hidden-shares

For current releases, check the repository’s help output before running these examples because command-line options can change between versions.

Exporting Share Enumeration Results

Saving the findings makes it easier to compare systems, investigate unusual share names, and prepare assessment reports. Choose the output format that fits your workflow.

Export to JSON:

./FindUncommonShares.py [options] --export-json shares.json

Export to Excel:

./FindUncommonShares.py [options] --export-xlsx shares.xlsx

Export to SQLite:

./FindUncommonShares.py [options] --export-sqlite shares.db

Replace [options] with the required authentication and domain arguments. JSON works well for automated processing, XLSX is convenient for manual review, and SQLite supports database queries and repeatable analysis.

Reviewing Results and Share Exposure

An uncommon share is not automatically a vulnerability. Review each finding in context, paying attention to its purpose, owner, contents, and intended access permissions. Where supported by the installed version, access-checking options can help assess whether the authenticated user can read or write to a share.

Prioritize unexpected writable locations, shares containing sensitive business data, and permissions that exceed operational requirements. Coordinate any access checks with the system owner, especially in production environments where concurrent connections may create additional load.

For broader discovery workflows, explore these reconnaissance tools and techniques. Use FindUncommonShares only on domains and systems you are authorized to assess, and protect exported files because they can reveal internal hostnames, network addresses, and potentially sensitive share information.

Official project: FindUncommonShares on GitHub