File Download with NetExec (SMB)
Pivoting & Transfertool
Summary
Pulls a file off a remote SMB share using NetExec credentials, saving it locally with --get-file.
Walkthrough
Use NetExec (nxc) to grab a file from a remote host over SMB when you have valid credentials.
Steps
- Authenticate to the SMB service with
-uand-p. - Use
--get-filewith the remote path followed by the local output filename to download it.
Commands
bash
nxc smb <IP> -u '<USER>' -p '<PASS>' --get-file "Users\z.thomas\Downloads\Onboarding Document.docx" output.docx