> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/file-transfers/transfers-via-smb.md). # Transfers via SMB ## File uploads and downloads ### On Windows First mount the share (see below). Then just copy the file to/from the share ```bat copy revshell.exe z: ``` ```bat copy Z:\revshell.exe . ``` ### With smbclient To upload a file with `smbclient` ```bash smbclient //192.168.50.195/share -c 'put config.Library-ms' ``` ### With smbmap To download a file with `smbmap` ```bash smbmap -H 10.211.11.10 --download UserBackups/flag.txt ``` ## Mount a SMB share ### Mount a SMB share on Windows We can mount a share with `net use Z: \\\Share_name` Without credentials: ```bat net use Z: \\192.168.45.244\Kali ``` With credentials: ```bat net use Z: \\192.168.45.244\Kali /u:john my_password ``` ## Share Files via SMB ### Share files via SMB on Linux With `impacket-smbserver` you can share files from your Kali machine with a share named `kali` No login required: ```bash impacket-smbserver -smb2support kali . ``` Login required: ```bash impacket-smbserver -smb2support -username THMBackup -password CopyMaster555 public ~/smb_share ``` ## Usage information
impacket-smbserver -h ```bash ┌──(kali㉿kali)-[~] └─$ impacket-smbserver -h Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies usage: smbserver.py [-h] [-comment COMMENT] [-username USERNAME] [-password PASSWORD] [-hashes LMHASH:NTHASH] [-ts] [-debug] [-ip INTERFACE_ADDRESS] [-port PORT] [-dropssp] [-6] [-smb2support] [-outputfile OUTPUTFILE] shareName sharePath This script will launch a SMB Server and add a share specified as an argument. Usually, you need to be root in order to bind to port 445. For optional authentication, it is possible to specify username and password or the NTLM hash. Example: smbserver.py -comment 'My share' TMP /tmp positional arguments: shareName name of the share to add sharePath path of the share to add options: -h, --help show this help message and exit -comment COMMENT share's comment to display when asked for shares -username USERNAME Username to authenticate clients -password PASSWORD Password for the Username -hashes LMHASH:NTHASH NTLM hashes for the Username, format is LMHASH:NTHASH -ts Adds timestamp to every logging output -debug Turn DEBUG output ON -ip, --interface-address INTERFACE_ADDRESS ip address of listening interface ("0.0.0.0" or "::" if omitted) -port PORT TCP port for listening incoming connections (default 445) -dropssp Disable NTLM ESS/SSP during negotiation -6, --ipv6 Listen on IPv6 -smb2support SMB2 Support (experimental!) -outputfile OUTPUTFILE Output file to log smbserver output messages ```
smbclient --help ```bash ┌──(kali㉿kali)-[~] └─$ smbclient --help Usage: smbclient [OPTIONS] service -M, --message=HOST Send message -I, --ip-address=IP Use this IP to connect to -E, --stderr Write messages to stderr instead of stdout -L, --list=HOST Get a list of shares available on a host -T, --tar=IXFvgbNan Command line tar -D, --directory=DIR Start from directory -c, --command=STRING Execute semicolon separated commands -b, --send-buffer=BYTES Changes the transmit/send buffer -t, --timeout=SECONDS Changes the per-operation timeout -p, --port=PORT Port to connect to -g, --grepable Produce grepable output -q, --quiet Suppress help message -B, --browse Browse SMB servers using DNS Help options: -?, --help Show this help message --usage Display brief usage message Common Samba options: -d, --debuglevel=DEBUGLEVEL Set debug level --debug-stdout Send debug output to standard output -s, --configfile=CONFIGFILE Use alternative configuration file --option=name=value Set smb.conf option from command line -l, --log-basename=LOGFILEBASE Basename for log/debug files --leak-report enable talloc leak reporting on exit --leak-report-full enable full talloc leak reporting on exit Connection options: -R, --name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only -O, --socket-options=SOCKETOPTIONS socket options to use -m, --max-protocol=MAXPROTOCOL Set max protocol level -n, --netbiosname=NETBIOSNAME Primary netbios name --netbios-scope=SCOPE Use this Netbios scope -W, --workgroup=WORKGROUP Set the workgroup name --realm=REALM Set the realm name Credential options: -U, --user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username -N, --no-pass Don't ask for a password --password=STRING Password --pw-nt-hash The supplied password is the NT hash -A, --authentication-file=FILE Get the credentials from a file -P, --machine-pass Use stored machine account password --simple-bind-dn=DN DN to use for a simple bind --use-kerberos=desired|required|off Use Kerberos authentication --use-krb5-ccache=CCACHE Credentials cache location for Kerberos --use-winbind-ccache Use the winbind ccache for authentication --client-protection=sign|encrypt|off Configure used protection for client connections Deprecated legacy options: -k, --kerberos DEPRECATED: Migrate to --use-kerberos Version options: -V, --version Print version ```
smbmap -h ```bash ┌──(kali㉿kali)-[~] └─$ smbmap -h usage: smbmap [-h] (-H HOST | --host-file FILE) [-u USERNAME] [-p PASSWORD | --prompt] [-k] [--no-pass] [--dc-ip IP or Host] [-s SHARE] [-d DOMAIN] [-P PORT] [-v] [--signing] [--admin] [--no-banner] [--no-color] [--no-update] [--timeout SCAN_TIMEOUT] [-x COMMAND] [--mode CMDMODE] [-L | -r [PATH]] [-g FILE | --csv FILE] [--dir-only] [--no-write-check] [-q] [--depth DEPTH] [--exclude SHARE [SHARE ...]] [-A PATTERN] [-F PATTERN] [--search-path PATH] [--search-timeout TIMEOUT] [--download PATH] [--upload SRC DST] [--delete PATH TO FILE] [--skip] ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap options: -h, --help show this help message and exit Main arguments: -H HOST IP or FQDN --host-file FILE File containing a list of hosts -u, --username USERNAME Username, if omitted null session assumed -p, --password PASSWORD Password or NTLM hash, format is LMHASH:NTHASH --prompt Prompt for a password -s SHARE Specify a share (default C$), ex 'C$' -d DOMAIN Domain name (default WORKGROUP) -P PORT SMB port (default 445) -v, --version Return the OS version of the remote host --signing Check if host has SMB signing disabled, enabled, or required --admin Just report if the user is an admin --no-banner Removes the banner from the top of the output --no-color Removes the color from output --no-update Removes the "Working on it" message --timeout SCAN_TIMEOUT Set port scan socket timeout. Default is .5 seconds Kerberos settings: -k, --kerberos Use Kerberos authentication --no-pass Use CCache file (export KRB5CCNAME='~/current.ccache') --dc-ip IP or Host IP or FQDN of DC Command Execution: Options for executing commands on the specified host -x COMMAND Execute a command ex. 'ipconfig /all' --mode CMDMODE Set the execution method, wmi or psexec, default wmi Shard drive Search: Options for searching/enumerating the share of the specified host(s) -L List all drives on the specified host, requires ADMIN rights. -r [PATH] Recursively list dirs and files (no share\path lists the root of ALL shares), ex. 'email/backup' -g FILE Output to a file in a grep friendly format, used with -r (otherwise it outputs nothing), ex -g grep_out.txt --csv FILE Output to a CSV file, ex --csv shares.csv --dir-only List only directories, ommit files. --no-write-check Skip check to see if drive grants WRITE access. -q Quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when performing a search (-A). --depth DEPTH Traverse a directory tree to a specific depth. Default is 1 (root node). --exclude SHARE [SHARE ...] Exclude share(s) from searching and listing, ex. --exclude ADMIN$ C$' -A PATTERN Define a file name pattern (regex) that auto downloads a file on a match (requires -r), not case sensitive, ex '(web|global).(asax|config)' File Content Search: Options for searching the content of files (must run as root), kind of experimental -F PATTERN File content search, -F '[Pp]assword' (requires admin access to execute commands, and PowerShell on victim host) --search-path PATH Specify drive/path to search (used with -F, default C:\Users), ex 'D:\HR\' --search-timeout TIMEOUT Specifcy a timeout (in seconds) before the file search job gets killed. Default is 300 seconds. Filesystem interaction: Options for interacting with the specified host's filesystem --download PATH Download a file from the remote system, ex.'C$\temp\passwords.txt' --upload SRC DST Upload a file to the remote system ex. '/tmp/payload.exe C$\temp\payload.exe' --delete PATH TO FILE Delete a remote file, ex. 'C$\temp\msf.exe' --skip Skip delete file confirmation prompt Examples: $ smbmap -u jsmith -p password1 -d workgroup -H 192.168.0.1 $ smbmap -u jsmith -p 'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d' -H 172.16.0.20 $ smbmap -u 'apadmin' -p 'asdf1234!' -d ACME -Hh 10.1.3.30 -x 'net group "Domain Admins" /domain' ```
## Resources Impacket - GitHub: Impacket - Homepage: Impacket - Kali Tools: Impacket-scripts - Kali Tools: Net use - Microsoft Learn: smbclient - Linux manual page: