CAPEC-561
Windows Admin Shares with Stolen Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
On this page
Windows systems within the Windows NT family contain hidden network shares that are only accessible to system administrators. These shares allow administrators to remotely access all disk volumes on a network-connected system and further allow for files to be copied, written, and executed, along with other administrative actions. Example network shares include: C$, ADMIN$ and IPC$. If an adversary is able to obtain legitimate Windows credentials, the hidden shares can be accessed remotely, via server message block (SMB) or the Net utility, to transfer files and execute code. It is also possible for adversaries to utilize NTLM hashes to access administrator shares on systems with certain configuration and patch levels.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-561: Windows Admin Shares with Stolen Credentials: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/561.html and https://cve.bz/cve/capec/561?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Acquire known Windows administrator credentials] The adversary must obtain known Windows administrator credentials in order to access the administrative network shares.
5 techniques
- An adversary purchases breached Windows administrator credentials from the dark web.
- An adversary leverages a key logger or phishing attack to steal administrator credentials as they are provided.
- An adversary conducts a sniffing attack to steal Windows administrator credentials as they are transmitted.
- An adversary gains access to a Windows domain system/files and exfiltrates Windows administrator password hashes.
- An adversary examines outward-facing configuration and properties files to discover hardcoded Windows administrator credentials.
Experiment
They probe what they found.
[Attempt domain authentication] Try each Windows administrator credential against the hidden network shares until the target grants access.
1 technique
- Manually or automatically enter each administrator credential through the target's interface.
Exploit
They carry out the attack.
[Malware Execution] An adversary can remotely execute malware within the administrative network shares to infect other systems within the domain.
[Data Exfiltration] The adversary can remotely obtain sensitive data contained within the administrative network shares.
Prerequisites
The system/application is connected to the Windows domain.
The target administrative share allows remote use of local admin credentials to log into domain systems.
The adversary possesses a list of known Windows administrator credentials that exist on the target domain.
Skills required
- Low skill
Once an adversary obtains a known Windows credential, leveraging it is trivial.
Resources required
A list of known Windows administrator credentials for the targeted domain.
Signs of an attack
Data is being transferred and/or removed from administrative network shares.
Suspicious or Malicious software is executed within administrative network shares.
Suspicious or Malicious software is downloaded/installed on systems within the domain.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authentication | |
| Read Data | Confidentiality, Authorization | |
| Modify Data | Integrity |
Mitigations
Do not reuse local administrator account credentials across systems.
Deny remote use of local admin credentials to log into domain systems.
Do not allow accounts to be a local administrator on more than one system.
Weaknesses it exploits
- CWE-262 Not Using Password Aging
- CWE-263 Password Aging with Long Expiration
- CWE-294 Authentication Bypass by Capture-replay
- CWE-308 Use of Single-factor Authentication
- CWE-309 Use of Password System for Primary Authentication
- CWE-521 Weak Password Requirements
- CWE-522 Insufficiently Protected Credentials
Recent CVEs with these weaknesses
- –CVE-2026-97867
The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to…
- 6.0CVE-2026-89125
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of creden…
- 8.9CVE-2026-76966
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management,…
- 7.4CVE-2026-123801
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…
- 7.1CVE-2026-115340
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
- 6.6CVE-2026-112164
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
- –CVE-2026-111452
Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or…
- –CVE-2026-107474
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-653 Use of Known Operating System Credentials
Examples
APT32 has leveraged Windows' built-in Net utility to use Windows Administrative Shares to copy and execute re…
APT32 has leveraged Windows' built-in Net utility to use Windows Administrative Shares to copy and execute remote malware. [REF-579]
In May 2017, APT15 laterally moved within a Windows domain via Windows Administrative Shares to copy files to…
In May 2017, APT15 laterally moved within a Windows domain via Windows Administrative Shares to copy files to and from compromised host systems. This further allowed for the remote execution of malware. [REF-578]
MITRE's words, unchanged: CAPEC-561 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.