Impacket attrib.py

Back to the category index / Back to the command index

Overview

Queries and changes DOS/NTFS attributes of files and directories over SMB.

Item	Details
Implementation	examples/attrib.py
Category	SMB / MSRPC / NTLM
Size	341 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/attrib.py -h for the current option definitions.

Subcommands: ATTRIB_QUERY_ACTION, ATTRIB_SET_ACTION

Argument	Description
target	[[domain/]username[:password]@]
share	SMB share containing the file whose attributes you want to query or change.
path	Path to the file whose attributes you want to query or change.
-debug	Enable debug output.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Do not prompt for a password (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache file named by KRB5CCNAME, based on the target parameters; if no valid credentials are found, use those supplied on the command line.
-aesKey	AES key for Kerberos authentication (128 or 256 bits).
-p / --port	Destination SMB server port (default: 445)
-dc-ip	Domain controller IP address; if omitted, use the domain portion (FQDN) of the target.
-target-ip	Target IP address; if omitted, use the target value. Useful when the target is a NetBIOS name that cannot be resolved.
-t / --timeout	Connection timeout in seconds (default: 60)
-r / --readonly	Read-only file or directory. Applications can read a file but cannot write to or delete it. They cannot delete a read-only directory but can create or delete files in it.
-H / --hidden	Hidden file or directory, omitted from ordinary directory listings.
-s / --system	File or directory used partly or exclusively by the operating system.
-a / --archive	File or directory requiring archiving; applications use this attribute to mark files for backup or removal.
-n / --normal	File with no other attributes set. Specify this flag alone to clear all other flags.
-t / --temporary	File used for temporary storage. The operating system may hold its data in memory instead of mass storage, writing it to mass storage only if data remains when the file closes.
-c / --compressed	Compressed file or directory. All data in a file is compressed; for a directory, compression is the default for new files and subdirectories.
-o / --offline	File data that is not immediately available because it has been moved to offline storage. Remote Storage, a hierarchical storage management application, uses this attribute.
-e / --encrypted	Encrypted file or directory. All data streams in a file are encrypted; for a directory, encryption is the default for new files and subdirectories.
-p / --pinned	Indicates that a file or directory should remain fully present locally even when it is not being accessed. Used with hierarchical storage management software.
-u / --unpinned	Indicates that a file or directory need not remain fully present locally except while it is being accessed. Used with hierarchical storage management software.

Detailed processing flow

The tool opens an SMB session, tree, and file handle for the target, share, and path. query retrieves basic information and displays its flags. set applies +, -, or = changes to the current attributes, including read-only, hidden, system, and archive, then sends the appropriate set-info request for SMB1 or SMB2.

How it works

Windows file attributes are multiple bit flags stored in the file’s basic metadata. query connects to the SMB tree and opens the file. It obtains basic information through TRANS2/query information on SMB1, or the equivalent QUERY_INFO operation on SMB2/3, and FileAttributes.unpack() expands it into display flags.

set applies the requested +, -, or = operation to the current mask. Even when changing several flags, it combines them into one basic-information write and preserves unrelated fields in the same structure, such as timestamps. NORMAL has restrictions when combined with other flags, so a simple bitwise OR may give the wrong value.

SMB1 and SMB2 differ in their open access masks, share modes, information classes, and structure layouts. Reading only requires FILE_READ_ATTRIBUTES; changing attributes requires FILE_WRITE_ATTRIBUTES. Both directory and file paths are supported, and the handle is closed whether the query or change succeeds or fails.

Key implementation elements

Symbol	Location	Where to trace its responsibility
FileAttributes	76	pack(), unpack(), repr_attribs()
attrib_query()	164	Module function
attrib_set()	175	Module function
main()	198	Module function

Dependencies

Within Impacket

Module	Main names used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	smbconnection, version
impacket.nmb	SMB_SESSION_PORT
impacket.smb	FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_WRITE_ATTRIBUTES, SMBQueryFileBasicInfo, SMBSetFileBasicInfo, SMB_DIALECT, SMB_QUERY_FILE_BASIC_INFO, SMB_SET_FILE_BASIC_INFO
impacket.smb3structs	FILE_BASIC_INFORMATION, SMB2_FILE_BASIC_INFO

Output, side effects, and required privileges

• Some operations change the target’s state. Check the target name, SID, and path before making changes.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.

When changing the implementation

The code depends on smbconnection, smb, and smb3structs. FileAttributes.pack() and unpack() convert between the CLI representation and bitmasks; attrib_query() and attrib_set() handle protocol differences.

Verification

• Syntax: python -m py_compile examples/attrib.py
• CLI: python examples/attrib.py -h
• Related test: tests/SMB_RPC/test_nmb.py
• Related test: tests/SMB_RPC/test_smb.py
• Related test: tests/SMB_RPC/test_smbserver.py