SMB file operations cover browsing, downloading, uploading, deleting, and mounting shares. This is used for loot collection, payload staging in labs, script review, and verifying whether write access is real.
Interactive smbclient
smbclient //10.10.10.200/IT -U 'ootw.local\student%student'
Common smbclient commands
ls
cd Folder
pwd
get file.txt
mget *
put local.txt
mput *
del file.txt
mkdir test
rmdir test
recurse
prompt off
Non-interactive smbclient
smbclient //10.10.10.200/IT -U 'ootw.local\student%student' -c "ls"
smbclient //10.10.10.200/IT -U 'ootw.local\student%student' -c "get deploy.ps1"
smbclient //10.10.10.200/IT -U 'ootw.local\student%student' -c "recurse; prompt off; mget *"
smbclient //10.10.10.200/IT -U 'ootw.local\student%student' -c "put test.txt"
smbmap
smbmap -H 10.10.10.200 -d ootw.local -u student -p 'student' --download 'IT\deploy.ps1'
smbmap -H 10.10.10.200 -d ootw.local -u student -p 'student' --upload local.txt 'IT\local.txt'
smbmap -H 10.10.10.200 -d ootw.local -u student -p 'student' --delete 'IT\local.txt'
Mount share
sudo mkdir -p /mnt/it
sudo mount -t cifs //10.10.10.200/IT /mnt/it -o username=student,password='student',domain=ootw.local,vers=3.0,uid=1000,gid=1000
find /mnt/it -type f
Kerberos mount
export KRB5CCNAME=student.ccache
sudo mount -t cifs //dc01.ootw.local/SYSVOL /mnt/sysvol -o sec=krb5,cruid=$(id -u),vers=3.0
Unmount
sudo umount /mnt/it
sudo umount /mnt/sysvol
Notes
- Do not trust share-level write output alone.
- Always perform a harmless create and delete test when the exercise requires proof of write access.