Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt

Use this file to discover all available pages before exploring further.

get-netfileserver queries a domain controller via LDAP to retrieve all domain user objects and then extracts server hostnames referenced in the homeDirectory, scriptPath, and profilePath attributes. These attributes frequently contain UNC paths pointing to file servers that store sensitive user data, logon scripts, and roaming profiles. The command deduplicates and returns the unique set of hostnames, making it a fast and passive technique for discovering high-value file server targets without scanning the network. Results can be piped into other PywerView commands or used to target specific hosts for further enumeration.

Flags

-t, --dc-ip
string
required
IP address of the domain controller to query.
-w, --workgroup
string
Name of the domain to authenticate with.
-u, --user
string
Username for authentication against the domain controller.
-p, --password
string
Password associated with the specified username.
--hashes
string
NTLM hashes for pass-the-hash authentication. Format: [LMHASH:]NTHASH. The LM portion can be omitted or replaced with the empty LM hash.
-k
boolean
Use Kerberos authentication. Reads credentials from the KRB5CCNAME ccache file based on target parameters.
--tls
boolean
Force a TLS (LDAPS) connection to the domain controller.
--cert
string
Path to a certificate file for certificate-based authentication.
--key
string
Path to a private key file associated with the certificate for authentication.
--simple-auth
boolean
Force SIMPLE LDAP authentication instead of the default NTLM/Kerberos.
--target-users
string[]
Space-separated list of usernames to target when extracting file server paths. Wildcards are accepted (e.g., admin*). When omitted, all domain users are queried.
-d, --domain
string
Domain to query. Defaults to the domain of the authenticating user when not specified.
-l, --logging-level
string
Logging verbosity sent to stderr. Choices: CRITICAL (default), WARNING, DEBUG, ULTRA.
--json
boolean
Print results as JSON instead of the default human-readable format.

Examples

# Discover all file servers referenced in domain user profile attributes
pywerview get-netfileserver -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com

# Find file servers only referenced by specific users
pywerview get-netfileserver -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --target-users bob charlie dave

# Use wildcards to target admin accounts
pywerview get-netfileserver -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com \
  --target-users 'admin*'

# Kerberos authentication
pywerview get-netfileserver -t dc.contoso.com -w contoso.com -k

# JSON output
pywerview get-netfileserver -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com --json

Build docs developers (and LLMs) love