> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/reference/script-reference/smb-and-network-scripts.md).

# SMB & Network Scripts

This group covers scripts that interact with SMB shares, expose SMB services, read file-system structures, or work with the Windows registry.

## Script List

* `smbclient.py` -- Interactive SMB share browser
* `smbserver.py` -- Start an SMB server
* `smbpasswd.py` -- Change a user's password over SMB
* `changepasswd.py` -- Change/reset passwords (multiple protocols)
* `ntfs-read.py` -- Read NTFS alternate data streams
* `attrib.py` -- Get/set file attributes over SMB
* `karmaSMB.py` -- SMB server responding to any request (rogue server)
* `DumpNTLMInfo.py` -- Dump NTLM authentication info from a target
* `smbexec.py` -- (cross-ref from Remote Execution)

## Main Scripts

| Script             | Purpose                             | Potentially Useful Things to Cover                         |
| ------------------ | ----------------------------------- | ---------------------------------------------------------- |
| `smbclient.py`     | Interactive SMB client              | SMB login, share enumeration, file operations              |
| `smbserver.py`     | Simple SMB server                   | Server setup, share configuration, incoming authentication |
| `services.py`      | Service Control Manager client      | RPC over SMB, service listing and control                  |
| `reg.py`           | Remote registry manipulation        | Registry RPC, hive/key/value operations                    |
| `registry-read.py` | Offline registry hive reader        | Registry parsing without live RPC                          |
| `regsecrets.py`    | Extracts secrets from registry data | Registry secret locations and parsing                      |
| `attrib.py`        | File attribute operations           | SMB file metadata handling                                 |
| `ntfs-read.py`     | Reads NTFS structures               | Offline NTFS parsing                                       |
| `esentutl.py`      | Reads ESE database structures       | ESE parsing patterns                                       |
| `filetime.py`      | Converts Windows file times         | Timestamp conversion utility                               |
| `split.py`         | Splits files                        | Simple helper utility                                      |

## SMB Client

`smbclient.py` provides an interactive shell for SMB shares.

```bash
python examples/smbclient.py CONTOSO/alice:'Passw0rd!'@files01
```

Common actions inside the shell include:

```
shares
use ADMIN$
ls
get hosts
put local.txt remote.txt
```

As source code, this is the best starting point for learning how to connect to SMB, list shares, browse directories, and transfer files.

## SMB Server

`smbserver.py` exposes a local folder over SMB.

```bash
python examples/smbserver.py SHARE C:\Users\Public\share
```

With SMB2 support:

```bash
python examples/smbserver.py -smb2support SHARE C:\Users\Public\share
```

This script is especially useful for understanding Impacket's SMB server classes and for lab workflows that need a temporary file share.

## Services

`services.py` talks to the Service Control Manager.

```bash
python examples/services.py CONTOSO/alice:'Passw0rd!'@files01 list
```

Use it to study DCE/RPC bindings over SMB named pipes and how service operations are represented.

## Registry

`reg.py` manipulates the registry remotely.

```bash
python examples/reg.py CONTOSO/alice:'Passw0rd!'@files01 query -keyName HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion
```

`registry-read.py` is for offline hive parsing:

```bash
python examples/registry-read.py SYSTEM
```

Remote registry work teaches RPC access patterns. Offline registry work teaches parsing and data extraction without touching a live host.

## File and Database Parsing

`ntfs-read.py` and `esentutl.py` are useful when you want to learn how Impacket parses Windows storage formats. They are different from network tools: the interesting logic is in local parsing, record walking, and binary structure handling.

## Considerations

SMB examples often require firewall access to TCP 445 and permissions to the relevant share. Registry and service operations usually require stronger privileges than simple file reads. When Kerberos is enabled, use hostnames that match service tickets rather than raw IP addresses.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.impacket.wiki/reference/script-reference/smb-and-network-scripts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.