Impacket smbclient.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”An interactive shell for working with SMB shares, directories, files, and ACLs. It also accepts an input file for batch execution.
| Item | Details |
|---|---|
| Implementation | examples/smbclient.py |
| Category | SMB / MSRPC / NTLM |
| Size | 130 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/smbclient.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-inputfile | File containing commands to run in the mini shell. |
-outputfile | File in which to log smbclient actions. |
-debug | Enable debug output. |
-ts | Add a timestamp to each log message. |
-hashes | NTLM hashes in LMHASH:NTHASH format. |
-no-pass | Do not prompt for a password (useful with -k). |
-k | Use Kerberos authentication. Read credentials from the ccache file named by KRB5CCNAME, based on the target parameters; if no valid credentials are found, use those supplied on the command line. |
-aesKey | AES key for Kerberos authentication (128 or 256 bits). |
-dfs-follow | Automatically follow DFS links by creating SMB connections to target servers. Disabled by default for OPSEC reasons; use the shell’s dfs_mode command to toggle it at runtime. |
-dc-ip | Domain controller IP address; if omitted, use the domain portion (FQDN) of the target. |
-target-ip | Target IP address; if omitted, use the target value. Useful when the target is a NetBIOS name that cannot be resolved. |
-port | Destination SMB server port (choices: 139, 445; default: 445) |
Related techniques: SMB / NetBIOS, NTLM / SPNEGO.
Detailed processing flow
Section titled “Detailed processing flow”The tool creates an SMBConnection from the parsed target and authentication options. After dialect negotiation and login, it passes the connection to MiniImpacketShell. The shell dispatches commands such as share listing, cd, ls, get, put, mount, and info, then logs off on exit.
How it works
Section titled “How it works”The CLI file bootstraps an authenticated SMBConnection and passes it to
MiniImpacketShell. Connection setup negotiates the dialect, logs in through
NTLM or Kerberos, and determines server capabilities. Subsequent shell commands
reuse the same session. DFS following changes how the connection switches targets when a path returns a referral.
The shell tracks the current share and directory as state. shares, use,
and ls work with trees and directories; get and put read and write files;
ACL and information commands send additional SMB requests. It separates
commands that touch the local filesystem from commands for remote SMB paths,
handling Windows path separators and wildcards according to server semantics.
Batch input uses the same command dispatcher as interactive input, so behavior
can stay consistent apart from the prompt. File handles, tree connections, and
secondary DFS connections close when the shell exits. It shows SessionError
status codes per command; a missing file need not tear down the whole session.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
main() | 31 | Module function |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.examples.smbclient | MiniImpacketShell |
impacket | version |
impacket.smbconnection | SMBConnection |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Some operations change the target’s state. Check the target name, SID, and path before making changes.
- Depending on the options, it creates or updates local files. Check how existing files are handled and the permissions on output containing secrets.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on impacket.examples.smbclient.MiniImpacketShell and SMBConnection. The CLI file only bootstraps the session; add commands in the shared shell class.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/smbclient.py - CLI:
python examples/smbclient.py -h - No test specific to this command was found. Use tests for shared modules and, when needed, test its behavior in an isolated environment.