Skip to content
HackIndex logo

HackIndex

Backup Files on SMB Shares

2 min read Mar 7, 2026

Backup exposure is worth its own page because it often changes the engagement faster than generic file discovery. A readable backup can give you credentials, registry exports, database dumps, configuration snapshots, user data, or entire virtual disk content without exploiting anything.

Start by searching accessible shares for obvious backup file types and names.

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD" -A "(?i)(backup|bak|old|zip|7z|rar|tar|gz|sql|dump|vhd|vhdx|bkf|wbadmin|pst)$"
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -A "(?i)(backup|bak|old|zip|7z|rar|tar|gz|sql|dump|vhd|vhdx|bkf|wbadmin|pst)$"

Then inspect the surrounding directories so you understand what the backup belongs to.

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD" -r
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Shared -U "$USER%$PASSWORD" -c "recurse; ls"

If you find a likely target, pull only what you need.

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Shared -U "$USER%$PASSWORD" -c "get finance_backup.zip"
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Public -N -c "get server.vhdx"

What changes your next move is the backup type. Database exports point toward application credentials and records. Virtual disk images point toward offline filesystem review. User mail archives and config backups often reveal passwords, tokens, and internal access details. Even a single accessible backup file can be a stronger finding than a broad anonymous share with no sensitive content.

References