Impacket filetime.py

Back to the category index / Back to the command index

Overview

Queries and changes the creation, access, write, and change times of files and directories over SMB.

Item	Details
Implementation	examples/filetime.py
Category	SMB / MSRPC / NTLM
Size	309 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/filetime.py -h for the current option definitions.

Subcommands: FILETIME_READ_ACTION, FILETIME_WRITE_ACTION

Argument	Description
target	[[domain/]username[:password]@]
share	SMB share containing the file or directory whose timestamps you want to query or change.
path	Path to the file or directory whose timestamps you want to query or change.
-debug	Enable debug output.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Do not prompt for a password (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache file named by KRB5CCNAME, based on the target parameters; if no valid credentials are found, use those supplied on the command line.
-aesKey	AES key for Kerberos authentication (128 or 256 bits).
-p / --port	Destination SMB server port (default: 445)
-dc-ip	Domain controller IP address; if omitted, use the domain portion (FQDN) of the target.
-target-ip	Target IP address; if omitted, use the target value. Useful when the target is a NetBIOS name that cannot be resolved.
-t / --timeout	Connection timeout in seconds (default: 60)
-c / --create	Change the file or directory’s CreationTime.
-a / --access	Change the file or directory’s LastAccessTime.
-w / --write	Change the file or directory’s LastWriteTime.
-m / --modify	Change the file or directory’s ChangeTime.
-r / --reference	File or directory whose timestamps to copy (format: ).
-t / --timestamp	Timestamp to set for the selected file times (format: YYYY-MM-DD_HH:MM:SS.mmmmmm).
-v / --validate	Query the file after touching it to verify the changes.

Detailed processing flow

query retrieves SMB basic information and converts FILETIME values to dates and times. touch builds new values from an explicit timestamp, a reference file, or the current time, preserves unspecified fields, and sends a set-info request. With --validate, it reads the values back after writing to verify them.

How it works

NTFS/SMB basic information contains four times: creation, last access, last write, and change. query converts them from FILETIME values to datetimes and display strings. Change time records metadata updates; it is not the same as content write time. The mapping between user options create/access/write/modify and the fields on the wire must remain consistent.

touch first reads the existing basic information, then replaces only the selected fields with new FILETIME values. Each value comes from an explicit timestamp, the matching field in a reference file, or the current time. Sending zero for an unspecified field has different SMB API semantics from preserving it, so handle each dialect’s set structure accordingly.

--validate reads the values again after writing and compares what the server stored. Account for filesystem timestamp precision, timezone display, and server-side rounding rather than relying only on exact string matches. Compare FILETIME units with appropriate tolerance, and use the correct handle permissions and share modes for both the reference and target.

Key implementation elements

Symbol	Location	Where to trace its responsibility
FileTimes	66	pretty_repr()
filetime_query()	85	Module function
filetime_set()	101	Module function
main()	120	Module function

Dependencies

Within Impacket

Module	Main names used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	smbconnection, version
impacket.nmb	SMB_SESSION_PORT
impacket.smb	FILE_READ_ATTRIBUTES, FILE_READ_DATA, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_WRITE_ATTRIBUTES, FILE_WRITE_DATA, FTtoPOSIX, POSIXtoFT, SMBQueryFileBasicInfo, SMBSetFileBasicInfo, SMB_DIALECT, SMB_QUERY_FILE_BASIC_INFO, SMB_SET_FILE_BASIC_INFO
impacket.smb3structs	FILE_BASIC_INFORMATION, SMB2_DIALECT_311, SMB2_FILE_BASIC_INFO
impacket.smb3	FILE_BASIC_INFORMATION

Output, side effects, and required privileges

• Some operations change the target’s state. Check the target name, SID, and path before making changes.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.

When changing the implementation

The code depends on smbconnection, SMB1/SMB2 basic-information structures, and POSIXtoFT / FTtoPOSIX. filetime_query() and filetime_set() handle dialect differences. Avoid inadvertently rounding timezone values or FILETIME precision.

Verification

• Syntax: python -m py_compile examples/filetime.py
• CLI: python examples/filetime.py -h
• Related test: tests/SMB_RPC/test_nmb.py
• Related test: tests/SMB_RPC/test_smb.py
• Related test: tests/SMB_RPC/test_smbserver.py