Impacket SMB Connections Made Simple
So it kinda bugged me awhile ago when I was trying to learn
impacket that there is not allot of documentation. The stuff that is out there is very select and rather old. Granted the best way to learn is to poke around and find the commands, but that proved very tiresome and not at all helpful. So I figured I would make a small post and explain some of the basics in the hopes that it might help someone else down the road.
There are many different ways to actually make a connection after trying a few I stumbled upon this and it seems the best... at least for me. It gives you access to all the upper level stuff as well as the low level stuff when and if you need it.
First we will import what we need:
from impacket.smbconnection import *
For some help if you need it:
help(SMBConnection)
Now we will start our connection:
con = SMBConnection('127.0.0.1', '127.0.0.1', preferredDialect=SMB2_DIALECT_002)
Notice that we can choose which dialect to use, this will automatically perform the smb negotiation, and will default to the highest available... but you can also use these!
SMB_DIALECT, SMB2_DIALECT_002, SMB2_DIALECT_21, and SMB2_DIALECT_30
Now we can login:
con.login('Administrator', 'Password', 'DOMAIN')
con.login('Administrator', '', 'DOMAIN', nthash='yourNThashgoeshere')
Notice that we have to specify '' for the password if supplying a hash!
So now we are logged in and we can do just about anything we like, for example..
Lets list all the shares:
shares = con.listShares()
for n in shares:
n.dump()
Lets write a file into the C:\Users folder... but remember your permissions
WILL come into play.
f = open('/tmp/awesome.dll', 'rb') # open file read binary
con.putFile('C$', r'\\Users\\awesome.dll', f.read)
f.close()
Lets download the same file:
f = open('/tmp/new_awesome.dll', 'wb') # open file write binary
con.getFile('C$', r'\\Users\\awesome.dll', f.write)
f.close()
Now lets delete it:
con.deleteFile('C$', r'\\Users\\awesome.dll')
To access all the stuff in the SMB/SMB3 classes:
lower_level = con.getSMBServer()
That's gonna be all for now, I'll write up a more advanced post on the lower level stuff sometime soon.
