> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/lateral-tool-transfer/transfers-via-smb.md). # Transfers via SMB ## File transfers on Linux ### File transfers via CrackMapExec crackmapexec smb ... ``` Files: Options for put and get remote files --put-file FILE FILE Put a local file into remote target, ex: whoami.txt \\Windows\\Temp\\whoami.txt --get-file FILE FILE Get a remote file, ex: \\Windows\\Temp\\whoami.txt whoami.txt ``` ### File transfers with impacket To create an SMB-share called `public` with the help of [impacket](https://www.coresecurity.com/core-labs/impacket)'s [smbserver](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/smbserver.py) ```bash impacket-smbserver -smb2support -username shareuser -password sharepassword public ~/smb_share ``` Connect to the machine on Windows with ```bat net use X: /user:shareuser \\\public sharepassword ``` Or copy files directly to the share like this ```bat copy file.exe \\\public\ ``` Note that this requires that both the current username and password **matches** the shareuser! ### File transfers via smbget ```bash ┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/Active] └─$ tldr smbget smbget wget-like utility for downloading files from SMB servers. More information: https://www.samba.org/samba/docs/current/man-html/smbget.1.html. - Download a file from a server: smbget smb://server/share/file - Download a share or directory recursively: smbget --recursive smb://server/share - Connect with a username and password: smbget smb://server/share/file --user username%password - Require encrypted transfers: smbget smb://server/share/file --encrypt ``` ### File transfers via smbmap #### File downloads via smbmap Use the `--download` parameter to download files ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/AD_Basic_Enumeration] └─$ smbmap -H 10.211.11.10 --download UserBackups/flag.txt ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap [*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 0 authenticated session(s) [+] Starting download: UserBackups\flag.txt (14 bytes) [+] File output to: /mnt/hgfs/Wargames/TryHackMe/Walkthroughs/Easy/AD_Basic_Enumeration/10.211.11.10-UserBackups_flag.txt [*] Closed 1 connections ``` #### File uploads via smbmap ``` --upload ``` ## File transfers on Windows ### Access an SMB share Connect to an SMB share with ```bat net use X: /user:shareuser \\\public sharepassword ``` Or copy files directly to the share like this ```bat copy file.exe \\\public\ ``` ### Create a share To create a share on a Windows machine ```bash net share My_share=C:\Data /grant:Everyone,full ``` Verify the share by listing all shares ```bat net share ``` ## Usage information
smbget --help ```bash ┌──(kali㉿kali)-[~] └─$ smbget --help Usage: smbget [OPTION...] -a, --guest Work as user guest -e, --encrypt Encrypt SMB transport -r, --resume Automatically resume aborted files -u, --update Download only when remote file is newer than local file or local file is missing --recursive Recursively download files -b, --blocksize=INT Change number of bytes in a block -o, --outputfile=STRING Write downloaded data to specified file --stdout Write data to stdout -D, --dots Show dots as progress indication -q, --quiet Be quiet -v, --verbose Be verbose --limit-rate=INT Limit download speed to this many KB/s Help options: -?, --help Show this help message --usage Display brief usage message Common Samba options: -d, --debuglevel=DEBUGLEVEL Set debug level --debug-stdout Send debug output to standard output -s, --configfile=CONFIGFILE Use alternative configuration file --option=name=value Set smb.conf option from command line -l, --log-basename=LOGFILEBASE Basename for log/debug files --leak-report enable talloc leak reporting on exit --leak-report-full enable full talloc leak reporting on exit Connection options: -R, --name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only -O, --socket-options=SOCKETOPTIONS socket options to use -m, --max-protocol=MAXPROTOCOL Set max protocol level -n, --netbiosname=NETBIOSNAME Primary netbios name --netbios-scope=SCOPE Use this Netbios scope -W, --workgroup=WORKGROUP Set the workgroup name --realm=REALM Set the realm name Credential options: -U, --user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username -N, --no-pass Don't ask for a password --password=STRING Password --pw-nt-hash The supplied password is the NT hash -A, --authentication-file=FILE Get the credentials from a file -P, --machine-pass Use stored machine account password --simple-bind-dn=DN DN to use for a simple bind --use-kerberos=desired|required|off Use Kerberos authentication --use-krb5-ccache=CCACHE Credentials cache location for Kerberos --use-winbind-ccache Use the winbind ccache for authentication --client-protection=sign|encrypt|off Configure used protection for client connections Deprecated legacy options: -k, --kerberos DEPRECATED: Migrate to --use-kerberos Version options: -V, --version Print version ```
smpmap -h ```bash ┌──(kali㉿kali)-[~] └─$ smbmap -h usage: smbmap [-h] (-H HOST | --host-file FILE) [-u USERNAME] [-p PASSWORD | --prompt] [-k] [--no-pass] [--dc-ip IP or Host] [-s SHARE] [-d DOMAIN] [-P PORT] [-v] [--signing] [--admin] [--no-banner] [--no-color] [--no-update] [--timeout SCAN_TIMEOUT] [-x COMMAND] [--mode CMDMODE] [-L | -r [PATH]] [-g FILE | --csv FILE] [--dir-only] [--no-write-check] [-q] [--depth DEPTH] [--exclude SHARE [SHARE ...]] [-A PATTERN] [-F PATTERN] [--search-path PATH] [--search-timeout TIMEOUT] [--download PATH] [--upload SRC DST] [--delete PATH TO FILE] [--skip] ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap options: -h, --help show this help message and exit Main arguments: -H HOST IP or FQDN --host-file FILE File containing a list of hosts -u, --username USERNAME Username, if omitted null session assumed -p, --password PASSWORD Password or NTLM hash, format is LMHASH:NTHASH --prompt Prompt for a password -s SHARE Specify a share (default C$), ex 'C$' -d DOMAIN Domain name (default WORKGROUP) -P PORT SMB port (default 445) -v, --version Return the OS version of the remote host --signing Check if host has SMB signing disabled, enabled, or required --admin Just report if the user is an admin --no-banner Removes the banner from the top of the output --no-color Removes the color from output --no-update Removes the "Working on it" message --timeout SCAN_TIMEOUT Set port scan socket timeout. Default is .5 seconds Kerberos settings: -k, --kerberos Use Kerberos authentication --no-pass Use CCache file (export KRB5CCNAME='~/current.ccache') --dc-ip IP or Host IP or FQDN of DC Command Execution: Options for executing commands on the specified host -x COMMAND Execute a command ex. 'ipconfig /all' --mode CMDMODE Set the execution method, wmi or psexec, default wmi Shard drive Search: Options for searching/enumerating the share of the specified host(s) -L List all drives on the specified host, requires ADMIN rights. -r [PATH] Recursively list dirs and files (no share\path lists the root of ALL shares), ex. 'email/backup' -g FILE Output to a file in a grep friendly format, used with -r (otherwise it outputs nothing), ex -g grep_out.txt --csv FILE Output to a CSV file, ex --csv shares.csv --dir-only List only directories, ommit files. --no-write-check Skip check to see if drive grants WRITE access. -q Quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when performing a search (-A). --depth DEPTH Traverse a directory tree to a specific depth. Default is 1 (root node). --exclude SHARE [SHARE ...] Exclude share(s) from searching and listing, ex. --exclude ADMIN$ C$' -A PATTERN Define a file name pattern (regex) that auto downloads a file on a match (requires -r), not case sensitive, ex '(web|global).(asax|config)' File Content Search: Options for searching the content of files (must run as root), kind of experimental -F PATTERN File content search, -F '[Pp]assword' (requires admin access to execute commands, and PowerShell on victim host) --search-path PATH Specify drive/path to search (used with -F, default C:\Users), ex 'D:\HR\' --search-timeout TIMEOUT Specifcy a timeout (in seconds) before the file search job gets killed. Default is 300 seconds. Filesystem interaction: Options for interacting with the specified host's filesystem --download PATH Download a file from the remote system, ex.'C$\temp\passwords.txt' --upload SRC DST Upload a file to the remote system ex. '/tmp/payload.exe C$\temp\payload.exe' --delete PATH TO FILE Delete a remote file, ex. 'C$\temp\msf.exe' --skip Skip delete file confirmation prompt Examples: $ smbmap -u jsmith -p password1 -d workgroup -H 192.168.0.1 $ smbmap -u jsmith -p 'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d' -H 172.16.0.20 $ smbmap -u 'apadmin' -p 'asdf1234!' -d ACME -Hh 10.1.3.30 -x 'net group "Domain Admins" /domain' ```
## Resources smbget - Linux manual page: Smbmap - GitHub: Smbmap - Kali Tools: