Backup Files on SMB Shares

Backup exposure is worth its own page because it often changes the engagement faster than generic file discovery. A readable backup can give you credentials, registry exports, database dumps, configuration snapshots, user data, or entire virtual disk content without exploiting anything.

Start by searching accessible shares for obvious backup file types and names. The regex catches archives and database dumps by extension. Many backup files use descriptive names like server_backup_2024 or db_dump_prod. SMBMap's -A flag filters by filename pattern and prints the share name, path, and filename for each match. Focus on files that combine a service name with a date or a prod marker. Those are usually production snapshots with real data. Run both authenticated and unauthenticated variants.

Hunting SMB Backup Files

Backup file types worth targeting:

• .bak, .zip, .7z, .tar.gz archives
• .sql, .dump database exports
• .vhd, .vhdx virtual disk images
• .pst Outlook mail archives
• .bkf Windows Backup files

Without credentials, some shares appear empty even when they contain readable files.

Then inspect the surrounding directories so you understand what the backup belongs to. The listing tells you whether the backup is part of a scheduled process or a one-off export. A dated folder structure suggests automation. Older copies may exist with different content or weaker protection. Look for README files, logs, or scripts adjacent to the backup. Backup scripts often contain the credentials used to take the snapshot. Share names matter too. A share named IT, Admin, or Backup is worth exhaustive listing. If a share shows access but pattern matching returns nothing, list it manually with smbclient. That rules out naming convention mismatches the regex does not cover.

If you find a likely target, pull only what you need. Check file size first with ls inside smbclient before downloading a large image over a slow connection. If the file is locked by a running process, the download may fail silently or return a partial file. Retry after hours or with a different share path when that happens.

What changes your next move is the backup type. Database exports point toward application credentials and records. Virtual disk images point toward offline filesystem review. User mail archives and config backups often reveal passwords, tokens, and internal access details. Even a single accessible backup file can be a stronger finding than a broad anonymous share with no sensitive content.

For SQL dumps, grep for INSERT statements that contain passwords, tokens, or API keys. Application config tables sometimes store secrets in plaintext rows. VHD and VHDX images can be mounted on Linux with guestfish or qemu-nbd. That gives you full filesystem access without the original system. Windows disk images expose SAM and SYSTEM hives. Pull those and run impacket-secretsdump against them offline to extract credential hashes.

PST files open in Thunderbird or with readpst. They frequently contain credential reset emails, MFA seed codes, or internal documentation with system access details. Web config backups such as web.config, .env, or applicationHost.config are high value. They regularly contain database connection strings and service account credentials in plaintext.

When files are password-protected, check adjacent scripts or README files before attacking the password. Default passwords matching the company name, a year, or the word backup are common. If smbmap returns no matches on a listable share, adjust the regex or inspect the directory directly. The tool can miss files when the share enforces directory-level access controls that differ from file-level permissions.