Impacket smbserver.py

Back to the category index / Back to the command index

Overview

Exposes a local directory as an SMB1/SMB2 share. NTLM/Kerberos authentication and read-only access can also be configured.

Item	Details
Implementation	`examples/smbserver.py`
Category	SMB / MSRPC / NTLM
Size	138 lines
Distribution	Installed as a script through `scripts=examples/*.py` in `setup.py`

CLI and input

Run python examples/smbserver.py -h for the current option definitions.

Argument	Description
`shareName`	Name of the share to add.
`sharePath`	Path of the share to add.
`-comment`	Share comment displayed when shares are requested.
`-username`	Username used to authenticate clients.
`-password`	Password for that username.
`-computeraccountname`	Computer account name used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-computeraccounthash`	Computer account NT hash used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-computeraccountaes`	Computer account AES key used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-computeraccountpassword`	Computer account NT hash used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-computeraccountdomain`	Computer account domain used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-dc-ip`	Domain controller IP address used to authenticate arbitrary clients with signing through NetLogon/Kerberos.
`-hashes`	NTLM hashes for the username in LMHASH:NTHASH format.
`-ts`	Add a timestamp to each log message.
`-debug`	Enable debug output.
`-ip / --interface-address`	Listening interface IP address (defaults to “0.0.0.0” or ”::”).
`-readonly`	Allow file reads only.
`-disablekerberos`	Do not offer Kerberos authentication.
`-disablentlm`	Do not offer NTLM authentication.
`-port`	TCP port for incoming connections (default: 445).
`-dropssp`	Disable NTLM ESS/SSP during negotiation.
`-6 / --ipv6`	Listen over IPv6.
`-smb2support`	Enable experimental SMB2 support.
`-outputfile`	File in which to log smbserver output messages.

Detailed processing flow

The tool builds a SimpleSMBServer from the share name, path, and server options, then configures credentials and hashes, SMB2, listen address and port, and authentication policy. For Kerberos, it registers machine account and domain controller details before entering the request loop with start().

How it works

SimpleSMBServer maps a local directory into the share namespace and handles SMB negotiation, session setup, tree connections, and file operations on the server side. The CLI translates the share name and path, listen address and port, SMB2 support, read-only setting, and authentication policy into server configuration, then starts the request loop.

For NTLM authentication, it registers a user and LM/NT hashes in the credential database and verifies client challenge/response messages. Kerberos requires a machine account key representing the server SPN, plus domain and DC details. -disablekerberos and -disablentlm change the available negotiation mechanisms; the behavior when both are disabled needs to be defined explicitly.

File operations must safely resolve client paths to local paths beneath the share root. Check .., symlinks, case sensitivity, and read-only enforcement against the local filesystem as well as the protocol access mask. Permission to bind port 445, IPv4/IPv6 support, session and file IDs for multiple clients, and secrets in log files are also part of the server lifecycle.

Key implementation elements

Symbol	Location	Where to trace its responsibility
module-level entry	1	Parses arguments and runs processing at the top level

Dependencies

Within Impacket

Module	Main names used
`impacket.examples`	`logger`
`impacket`	`smbserver`, `version`
`impacket.ntlm`	`compute_lmhash`, `compute_nthash`

Output, side effects, and required privileges

The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
The tool starts a listening socket or a long-running loop. Check the bind address, port, shutdown method, and shared state under concurrent connections.

Failure paths and cleanup

Check that shutdown requests, client disconnections, partial reads or writes, and worker exceptions do not leave the whole listener inconsistent.

When changing the implementation

The code depends on impacket.smbserver and ntlm.compute_*hash. The top-level CLI builds the server configuration directly. Handle authentication enable/disable combinations and failures to bind a privileged port explicitly.

Verification

Syntax: python -m py_compile examples/smbserver.py
CLI: python examples/smbserver.py -h
Related test: tests/SMB_RPC/test_smbserver.py
Related test: tests/SMB_RPC/test_ntlm.py