Windows Exfiltration over SMB and FTP
SMB and FTP are native Windows protocols with built-in client support on every Windows version. Both avoid dropping extra tooling on the target:
SMB (port 445) is the faster option with direct file copy and no encoding overhead
FTP (port 21) works as a fallback when SMB is blocked but legacy transfer is permitted outbound
Both support authentication, making them usable in environments that block anonymous connections
Neither protocol requires base64 encoding or additional binaries on the target.
Before transferring, compress and archive the target data into a single file. A zip or 7z archive reduces transfer size and limits the number of individual file events in endpoint logs. Use a temp path that blends in, such as C:\Windows\Temp or C:\ProgramData, rather than staging files somewhere conspicuous like the desktop.
SMB exfiltration
Set up the Impacket SMB server on your attack box. It listens on port 445 and accepts incoming connections from the target. The server runs on Linux. Once the server is up, use native Windows copy commands from the target to write files to the share. No additional tooling is needed on the target side.
Impacket v0.11.0 - Copyright 2023 Fortra [*] Config file parsed [*] Callback added for UUID 4B324FC8-... [*] Server started, listening on 0.0.0.0:445
Windows 10 1709 and later require SMBv2 or higher. The -smb2support flag in impacket handles this. If transfers fail with access denied errors, add authentication to the server and use net use with credentials on the target. Watch the impacket console: each successful file write logs the filename and source IP. A failed write produces no server-side log entry, so confirm from the target that the copy command exited cleanly.
Windows Defender and common EDR products do not flag SMB copy to an external IP by default. Firewall rules or DLP solutions may still block outbound port 445. If the transfer hangs without an error message, the firewall is likely dropping the connection silently. Fall back to FTP or switch to an HTTP-based transfer method in that case.
FTP exfiltration
FTP requires the Windows ftp.exe client, which ships with all default Windows installations. The script file method works in non-interactive shells where you cannot type commands manually. Write the FTP commands to a temp file, then pass it to ftp.exe with the -s flag. The binary mode flag is critical for non-text files. Without it, FTP performs ASCII translation and corrupts binary data.
Exfiltration via existing SMB shares
In internal network engagements, data does not always need to travel back to your attack box directly. Accessible shares on other internal hosts serve as staging points for collection before final extraction. This approach is useful when direct outbound connections from the target are blocked but lateral SMB connections between internal hosts are permitted.
Use PowerView's Find-DomainShare with -CheckShareAccess to identify writable shares across the domain. The Writeable property in the output confirms write access. Check the share path before writing: shares under user home directories or department folders carry lower detection risk than shares on dedicated file servers, which often have auditing enabled and generate alerts on new file writes.
After copying data to an internal share, retrieve it from a host that has outbound connectivity. If that host already has an SMB session to your attack box, you can pull directly from the staged location. Clean up after retrieval to reduce forensic artifacts. Delete the staged file and, if you used net use, disconnect the mapped drive before moving on.