smbclient : Backtrack 5: Non Menu Items: CLI Commands: smbclient

The smbclient command line application included in Backtrack Linux is a staple for pentesting. I would imagine anyone that has done a pentest has used it to quickly verify SMB (Server Message Block) or CIFS (Common Internet File System) shares. The smbclient manpage describes it as a FTP-like client to access SMB/CIFS resources on servers. Below we describe varios smbclient commands in details to provide a basic understanding of its capabilities and what output will look like when using this tool in Backtrack Linux.

The current smbclient version installed on Backtrack version 5 release 3 is smbclient version 3.4.7. The smbclient application is located in the /usr/bin directory. The below smbclient examples show some of the many uses of smbclient including remote SMB/CIFS share information, interaction with SMB/CIFS shares via login to remote server, and file transfers using SMB/CIFS shares.

[expand title=”smbclient Help Menu”]
root@bt:~# smbclient –help
Usage: smbclient service -R, –name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only
-M, –message=HOST Send message
-I, –ip-address=IP Use this IP to connect to
-E, –stderr Write messages to stderr instead of stdout
-L, –list=HOST Get a list of shares available on a host
-t, –terminal=CODE Terminal I/O code {sjis|euc|jis7|jis8|junet|hex}
-m, –max-protocol=LEVEL Set the max protocol level
-T, –tar=<c|x>IXFqgbNan Command line tar
-D, –directory=DIR Start from directory
-c, –command=STRING Execute semicolon separated commands
-b, –send-buffer=BYTES Changes the transmit/send buffer
-p, –port=PORT Port to connect to
-g, –grepable Produce grepable output
-B, –browse Browse SMB servers using DNS

Help options:
-?, –help Show this help message
–usage Display brief usage message

Common samba options:
-d, –debuglevel=DEBUGLEVEL Set debug level
-s, –configfile=CONFIGFILE Use alternate configuration file
-l, –log-basename=LOGFILEBASE Base name for log files
-V, –version Print version

Connection options:
-O, –socket-options=SOCKETOPTIONS socket options to use
-n, –netbiosname=NETBIOSNAME Primary netbios name
-W, –workgroup=WORKGROUP Set the workgroup name
-i, –scope=SCOPE Use this Netbios scope

Authentication options:
-U, –user=USERNAME Set the network username
-N, –no-pass Don’t ask for a password
-k, –kerberos Use kerberos (active directory) authentication
-A, –authentication-file=FILE Get the credentials from a file
-S, –signing=on|off|required Set the client signing state
-P, –machine-pass Use stored machine account password
-e, –encrypt Encrypt SMB transport (UNIX extended servers only)
root@bt:~#
[/expand]

smbclient Usage Menu:

It should be noted that all SMB/CIFS traffic is plain text and could easily be viewed via any form of network packet monitoring unless specifically specified with the smbclient -e switch. It is likely that you would only find encryption support on Linux servers with SMB file shares.

The first couple of examples below show smbclient being used to query remote servers to enumerate details of SMB/CIFS shares. Note the –no-pass switch that can be used to query remote servers to see if SMB/CIFS shares are open to the world. The second example below queries a server with file shares that require a password so the first query to that device returns no available shares but the third example authenticates using a known username and password which then returns available SMB/CIFS network shares on the Windows 7 server.

smbclient: List Remote SMB/CIFS Shares That Do Not Require A Password

smbclient: Attempt To List Unprotected SMB/CIFS Shares Without Success

The request above was unsuccessful because the file shares on 192.168.1.75 require authentication to query information or connection as shown in the below example output where a username and password are used to display the available file shares on the Windows 7 server.

smbclient: List Protected SMB/CIFS Shares By Authenticating With A User/Pass

Those are the primary informational smbclient queries but that is only the tip of the iceberg in terms of smbclient capabilities. Next we show a couple examples of making connections to remote servers using smbclient and then interacting with the remote server either by file manipulation, information gathering, or transferring data to/from the server. The below output captures an entire session of a connection to a remote server using smbclient and numerous tasks such as listing files on the server, gathering information from the server, and transferring data to and from the server.

smbclient: SMB Command Prompt Capabilities

A brief summary of the above interaction with the remote Windows 7 server using the smb command line is detailed in the list below including the command issued and a very brief explanation of what it does.

• ? – lists the smb prompt help menu
• ? lock – question mark <command> provides details about any of the available commands within the smb command line
• listconnect – will provide a list of open connections to the server
• showconnect – provides details about your connection to the server
• altname mseinstall.exe – provides the alternative name to a filename if an alternative name exists which it does in the case of the mseinstall.exe file
• allinfo Console-2 – provides all available details about a file which in this case is the Console-2 file
• du DynSetup.exe – provides file size information and total directory size information in this case DynSetup.exe represents 59609 blocks of the 33554432 blocks in the directory
• mkdir SMBCLIENTTESTDIR – create a directory by the name of SMBCLIENTTESTDIR
• dir SMBC* – the dir command will list all contents in the current directory unless string is passed then it will list files named by the string or if the * is used its a wildcard
• cd SMBCLIENTTESTDIR – change directory into the previously created directory
• dir – show that the newly created directory is empty by listing its contents
• put desktop.ini – upload a file located in the directory from which the initial smbclient command was issued which in this case uploads desktop.ini
• dir – list directory contents which in this case shows the newly uploaded desktop.ini
• rm desktop.ini – remove a file so in this case we are deleting the file we just uploaded, wanted to show how easy it is for remote file manipulation
• cd ../ – change directory up one level to the initial directory
• rmdir SMBCLIENTTESTDIR – remove a directory which in this case is the SMBCLIENTTESTDIR we initially created, again easily manipulating the remote file system
• dir SMBC* – confirming there are no files or directories that start with SMBC left in the current directory

The above commands issued summary is only a portion of the available commands but demonstrates fairly well how powerful smbclient can be especially when encountering unprotected SMB/CIFS file shares. An attacker could literally wreck a server via SMB if it is not configured properly. Now in the last set of examples we show how you can transfer files to and from a server using smbclient. Both of the below examples are perfect for scripting so if you wanted to create a loop to try to post a file to every server in a /24 network or something.

smbclient: Download File From Password Protected CIFS File Share

smbclient: Upload File To Unprotected CIFS File Share

You should now have a good overview of the smbclient command line application capabilities but don’t forget to run “man smbclient” to obtain even more details about each of the available switches available to smbclient on Backtrack Linux. If anyone has any other useful smbclient commands please list them in the comments below because I feel like I am always finding out something else that smbclient is useful for!