# snaffler.exe

snaffler absolutely rules and finding good SMB share treasures!

I've been having Snaffler performance problems where no matter what I do, the processor and/or memory slowly max out. After a TON of troubleshooting, here's what worked for me:

Once you get Snaffler snafflin', go into Task Manager > Details, then right-click the snaffler.exe and choose Set Affinity and then only check one processor. Snaffler took forever but did NOT render my system unusable.

# Spawn a "runas" box

You'll want to spawn a "runas" command window under the context of your test Active Directory account. Syntax for that is here.

# General domain-wide snaffling

I haven't been able to confirm this for sure, but I think performance is better if I leave out the -s flag in the command below

snaffler.exe -s -d domain.com -c THE.DC.IP.ADDRESS -o snaffy.log -m DUMPFOLDER

# General domain-wide snaffling (with JSON output)

Same command but specify something like -o snaffy.json and specify JSON type with the flag -t JSON:

snaffler.exe -s -d domain.com -c THE.DC.IP.ADDRESS -o snaffy.json -m DUMPFOLDER -t JSON

snaffler -s -d domain.com -c IP-OF-DOMAIN-CONTROLLER -o snaffspecific.log -n SOME-SYSTEM -m folder-to-dump-files-to

# Extract passwords and save to `snaffpasswords.txt`

grep -Po 'Password="\K[^"]+' snaffpass.txt | grep -Ev '^\{?Password\}?$|^\.\+\($' > snaffpasswords.txt

# Extract full lines containing `asplaintext` (case-insensitive) and save to snaffasplaintext.txt

grep -i 'asplaintext' snaffpass.txt > snaffasplaintext.txt

# snaffler.exe

# Spawn a "runas" box

# General domain-wide snaffling

# General domain-wide snaffling (with JSON output)

# Targeted snaff of a specific machine share

# Extract passwords and save to snaffpasswords.txt

# Extract full lines containing asplaintext (case-insensitive) and save to snaffasplaintext.txt

# Extract passwords and save to `snaffpasswords.txt`

# Extract full lines containing `asplaintext` (case-insensitive) and save to snaffasplaintext.txt