KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #codex #typescript #developer-tools #ai-agents #deepseek-harness #claude-code #ai-agent #cli #react #mcp

SMBLoot

★ 71 Open GitHub ↗

SMBLoot is a terminal interface for browsing SMB shares, reading remote files, downloading and uploading files, and recursively inspecting remote directory trees.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# SMBLoot

SMBLoot is a terminal interface for browsing SMB shares, reading remote
files, downloading and uploading files, and recursively inspecting remote
directory trees.

```ps1
uv run SMBLoot.py --server 10.10.10.10 --username Administrator --password P@ssw0rd
uv run SMBLoot.py --server 10.10.10.10 --username Administrator --hash :E19CCF75EE54E06B06A5907AF13CEF42
```

![SMBLoot GIF](https://raw.githubusercontent.com/swisskyrepo/SMBLoot/main/images/SMBLoot.gif)

## SMB connection options

Every option can also be provided through an environment variable.

| Option | Environment variable | Purpose |
|---|---|---|
| `--server` | `SMB_TUI_SERVER` | SMB server address |
| `--remote-name` | `SMB_TUI_REMOTE_NAME` | NetBIOS name when it differs from the server address |
| `--mode` | `SMB_TUI_MODE` | Operating mode shown in the interface. Defaults to `LIVE` |
| `--username` | `SMB_TUI_USERNAME` | SMB username |
| `--password` | `SMB_TUI_PASSWORD` | SMB password |
| `--hash` | `SMB_TUI_HASH` | NT hash or `LMHASH:NTHASH` for pass-the-hash authentication |
| `--domain` | `SMB_TUI_DOMAIN` | Authentication domain |
| `--port` | `SMB_TUI_PORT` | SMB port; defaults to `445` |
| `--timeout` | `SMB_TUI_TIMEOUT` | Connection timeout in seconds; defaults to `30` |
| `--tree-workers` | `SMB_TUI_TREE_WORKERS` | Parallel SMB sessions for tree scans/downloads; defaults to `4` (maximum `16`) |
| `--share` | `SMB_TUI_SHARE` | Share to open at startup |
| `--path` | `SMB_TUI_PATH` | Initial directory inside `--share` |
| `--loot-dir` | `SMB_TUI_LOOT_DIR` | Local download directory; defaults to `./loot` |
| `--auto-loot-preview` | `SMB_TUI_AUTO_LOOT_PREVIEW` | Automatically download successfully previewed files; disabled by default |
| `--highlight-sensitive-files` | `SMB_TUI_HIGHLIGHT_SENSITIVE_FILES` | Display potentially sensitive files in orange; enabled by default |

Exactly one authentication method is required: `--password` or `--hash`.
The two options cannot be used together. The same rule applies to
`SMB_TUI_PASSWORD` and `SMB_TUI_HASH`.

Authenticate with an **NT hash**:

```bash
uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --hash 0123456789abcdef0123456789abcdef
```

Enable **automatic looting** while previewing files:

```bash
uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --auto-loot-preview
```

Auto-looted files use the same share and remote-directory structure under
`--loot-dir`. Existing local files are preserved using numbered filenames.

Highlight potentially sensitive files in orange:

```bash
uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --highlight-sensitive-files
```

Matching is case-insensitive and applies to filenames containing `.kdbx`,
`password`, `.vmdk`, `.ova`, `.cert`, `.pem`, or `_history`. Use
`--no-highlight-sensitive-files` to disable highlighting.

## Browser modes

`LIVE` mode is enabled by default. Opening a folder always refetches its listing
and replaces the cached snapshot. The top-right indicator is displayed as
`[LIVE]` in red.

`OPSEC` displays `[OPSEC]` in green. Its first visit to a folder fetches and
caches the listing; later visits display that snapshot without another query:

```bash
uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --mode OPSEC
```

Press `[m]` to toggle modes without reconnecting, or use `/mode live` and
`/mode opsec`. Switching modes preserves all cached listings. In either mode,
`[r]` and `/refresh` force a new snapshot. Successful uploads, file deletions,
and directory changes may also refetch the affected listing so the operator's
own changes are immediately visible.

## Parallel tree operations

`/tree` scans directory breadth levels across separate SMB sessions, so no
Impacket connection is accessed concurrently. `/tree_download` then assigns
files to workers by total expected bytes, which prevents one worker from being
stuck with all large files. The default is four sessions; use
`--tree-workers 1` for serial operation or select a value up to `16`.

## Browser keys

| Key | Action |
|---|---|
| `[UP]` or `[k]` | Select the previous entry |
| `[DOWN]` or `[j]` | Select the next entry |
| `[PAGE UP]` / `[PAGE DOWN]` | Move by one screen |
| `[HOME]` or `[g]` | Select the first entry |
| `[END]` or `[G]` | Select the last entry |
| `[ENTER]` | Open the selected share, directory, or file |
| `[BACKSPACE]` | Return to the parent |
| `[/]` | Open the command prompt |
| `[d]` | Download the selected file |
| `[SUPPR]` | Delete the selected file after confirmation |
| `[h]` | Display keyboard and command help |
| `[q]` | Quit |
| `[r]` | Refresh the current listing |
| `[m]` | Toggle between LIVE and OPSEC modes |
| `[n]` | Jump to the next highlighted `/grep` match in a file preview |

## Command prompt

Press `[/]` in the browser or file viewer, then enter one of these commands.

| Command | Description |
|---|---|
| `/get`, `/download`, or `/dl` | Download the selected file, or the open file when used from the viewer. |
| `/get <filename>` | Download a named file from the current remote directory. |
| `/put <local-path>` | Upload a local file to the current remote directory. Quote paths containing spaces. |
| `/filter <pattern>` | Filter the current listing using a case-insensitive regular expression or glob. |
| `/filter` | Clear the active listing filter. |
| `/refresh` | Refetch the current listing and replace its cached snapshot. |
| `/mode live`, `/mode opsec` | Switch browser mode without reconnecting. |
| `/grep <regex>` | Highlight case-insensitive regex matches; the active match uses a distinct color. |
| `/grep` | Clear file-preview match highlighting. |
| `/tree` | Recursively list files below the current share and directory in an interactive tree view. |
| `/tree_download` | Recursively download files below the current share and directory. |
| `/rm [<filename>]` | Delete the selected or open file when no filename is given, or delete a named file. These commands do not delete directories. |
| `/mkdir <directory>` | Create a directory inside the current remote directory. |
| `/rmdir [<directory>]` | Remove the selected empty directory when no name is given, or remove a named empty directory. |
| `/help` | Display keyboard shortcuts and available commands. |
| `/exit` or `/quit` | Exit SMBLoot from any view. |
| `/download <filename>` | Alias for `/get`. |
| `/dl <filename>` | Alias for `/get`. |
| `/upload <local-path>` | Alias for `/put`. |
| `/delete [<filename>]` | Alias for `/rm`. |

Autocomplete: Press `[TAB]` while entering a download, upload, file-delete, or `/rmdir`
command to complete remote filenames, remote directories, or local paths.

## Tree view keys

| Key | Action |
|---|---|
| `[UP]` or `[k]` | Select the previous file |
| `[DOWN]` or `[j]` | Select the next file |
| `[PAGE UP]` / `[PAGE DOWN]` | Move the selection by one screen |
| `[HOME]` or `[g]` | Select the first file |
| `[END]` or `[G]` | Select the last file |
| `[ENTER]` | Open the selected file |
| `[d]` | Download the selected file |
| `[SUPPR]` | Delete the selected file after confirmation |
| `[/]` | Open the command prompt; `/get`, `/download`, or `/dl` downloads the selected file |
| `[h]` | Display keyboard and command help |
| `[ESC]`, `[BACKSPACE]`, or `[q]` | Return to the browser |

### Filter Examples

Glob example:

```text
/filter *.csv
```

Regex example that displays entries except names ending in `.csv` or `.pdf`:

```text
/filter (?i)^(?!.*\.(?:csv|pdf)$).*$
```

Clear the current filter:

```text
/filter
```

## Testing

Install the runtime dependency, then run the unit-test suite:

```bash
uv run --with 'impacket>=0.13.1' python -m unittest discover --start-directory tests --verbose
# or
python -m pip install --requirement requirements.txt
python -m unittest discover --start-directory tests --verbose
```

GitHub Actions runs the same tests and Ruff checks for every push and pull
request.

SMBLoot

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README