Mike Sheward
if you ever stumble across a folder called 'temp' on a file share on any corporate network, nine times out of ten it's 24 years old and contains everything you need to assume ownership over both the network and the company
Apr 14 at 4:25amWeb
Show threadC.B.LeslieApr 14
@SecureOwl used to do this sort of thing with college ftp servers Japan in the early 00's.
Show threadTimjanApr 14
@SecureOwl
I assume the second and third Temp folders are just decoys, right?
Show threadfukawi2Apr 14
@SecureOwl Either that or a folder called "Dan's Stuff" inside a folder called "Accounts", inside a folder called "Old D Drive", all with zero security.
Show threadThird spruce tree on the leftApr 14
@phs @SecureOwl no no that folder contains some really choice anime.
Show threadSnep Apr 14
@SecureOwl And a file "initpwds.txt" of the same vintage contains the initial but to this day unchanged administrator credentials for any core servers, routers and switches from when it was first set up, readablw by anyone...
Show threadScannerApr 14
@SecureOwl @vaurora mine are called “tmp”, though.
Show threadTommy KavanaghApr 14
@SecureOwl I feel so seen damnit 🤔
Show threadkatApr 14
@SecureOwl ouch! I feel so called out.
Show threadNosaj  Apr 14

@SecureOwl

.temp

Show threadProfessor_StevensApr 14

@SecureOwl

Keep drilling. The best stuff is often in /temp/temp.

Show threadTomi the Slav and 1024 othersApr 14
@SecureOwl Once a sysadmin almost killed me because I deleted temp folder on the department's file server.
He was extremely pissed of at me and said: Don't you know the real meaning of 'temp'? It's DO NOT DELETE!.
Show threadVickie GrayApr 14
@SecureOwl true.
Show threadtuberosumApr 14
@SecureOwl I recently bought a Thinkpad R40 in a flea market (literally called "Dumpster Divers' market") , and after examining the hard drive I discovered it was used in the 00s as a thin client in some corporate network but in a temp folder there were multiple gigabytes of corporate emails, promo materials, internal memos, names, emails, phone numbers etc. I wonder what would an exhaustive search find...
Show threadJamesTDGApr 14
@SecureOwl *takes notes*
Show threadNazoApr 14
@SecureOwl Joke's on you. I name my temporary folders tmp instead.
Show threadRaederleApr 14
@SecureOwl I once authorized a folder named linux to be deleted from a fileshare. Inside of that Linux folder, buried in folder after folder ultimately labeled as “ice cream” was a VHD that was the email server. Thanks to that, we slowly started implementing “better practices” for managing Microsoft Windows servers. I can’t say best practices but they did get better.
Show threadchris48sApr 14
@SecureOwl my SMB share is in this picture and I don't like it.
Show threadJust a BillApr 14
@SecureOwl @Lundemo I named it “junk” so I guess I’m safe
Show threadKlaus FrankApr 15
@SecureOwl
There is also a 2nd case that is less "helful":
It may just contains a single "thumbs.de" file or has missconfigured ACLs that allowed it be renamed but not deleted or similar