SMBLoot

SMBLoot is a terminal interface for browsing SMB shares, reading remote files, downloading and uploading files, and recursively inspecting remote directory trees.

uv run SMBLoot.py --server 10.10.10.10 --username Administrator --password P@ssw0rd
uv run SMBLoot.py --server 10.10.10.10 --username Administrator --hash :E19CCF75EE54E06B06A5907AF13CEF42

SMB connection options

Every option can also be provided through an environment variable.

Option	Environment variable	Purpose
--server	SMB_TUI_SERVER	SMB server address
--remote-name	SMB_TUI_REMOTE_NAME	NetBIOS name when it differs from the server address
--mode	SMB_TUI_MODE	Operating mode shown in the interface. Defaults to LIVE
--username	SMB_TUI_USERNAME	SMB username
--password	SMB_TUI_PASSWORD	SMB password
--hash	SMB_TUI_HASH	NT hash or LMHASH:NTHASH for pass-the-hash authentication
--domain	SMB_TUI_DOMAIN	Authentication domain
--port	SMB_TUI_PORT	SMB port; defaults to 445
--timeout	SMB_TUI_TIMEOUT	Connection timeout in seconds; defaults to 30
--tree-workers	SMB_TUI_TREE_WORKERS	Parallel SMB sessions for tree scans/downloads; defaults to 4 (maximum 16)
--share	SMB_TUI_SHARE	Share to open at startup
--path	SMB_TUI_PATH	Initial directory inside --share
--loot-dir	SMB_TUI_LOOT_DIR	Local download directory; defaults to ./loot
--auto-loot-preview	SMB_TUI_AUTO_LOOT_PREVIEW	Automatically download successfully previewed files; disabled by default
--highlight-sensitive-files	SMB_TUI_HIGHLIGHT_SENSITIVE_FILES	Display potentially sensitive files in orange; enabled by default

Exactly one authentication method is required: --password or --hash. The two options cannot be used together. The same rule applies to SMB_TUI_PASSWORD and SMB_TUI_HASH.

Authenticate with an NT hash:

uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --hash 0123456789abcdef0123456789abcdef

Enable automatic looting while previewing files:

uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --auto-loot-preview

Auto-looted files use the same share and remote-directory structure under --loot-dir. Existing local files are preserved using numbered filenames.

Highlight potentially sensitive files in orange:

uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --highlight-sensitive-files

Matching is case-insensitive and applies to filenames containing .kdbx, password, .vmdk, .ova, .cert, .pem, or _history. Use --no-highlight-sensitive-files to disable highlighting.

Browser modes

LIVE mode is enabled by default. Opening a folder always refetches its listing and replaces the cached snapshot. The top-right indicator is displayed as [LIVE] in red.

OPSEC displays [OPSEC] in green. Its first visit to a folder fetches and caches the listing; later visits display that snapshot without another query:

uv run SMBLoot.py \
  --server 10.10.10.10 \
  --username Administrator \
  --password P@ssw0rd \
  --mode OPSEC

Press [m] to toggle modes without reconnecting, or use /mode live and /mode opsec. Switching modes preserves all cached listings. In either mode, [r] and /refresh force a new snapshot. Successful uploads, file deletions, and directory changes may also refetch the affected listing so the operator's own changes are immediately visible.

Parallel tree operations

/tree scans directory breadth levels across separate SMB sessions, so no Impacket connection is accessed concurrently. /tree_download then assigns files to workers by total expected bytes, which prevents one worker from being stuck with all large files. The default is four sessions; use --tree-workers 1 for serial operation or select a value up to 16.

Browser keys

Key	Action
[UP] or [k]	Select the previous entry
[DOWN] or [j]	Select the next entry
[PAGE UP] / [PAGE DOWN]	Move by one screen
[HOME] or [g]	Select the first entry
[END] or [G]	Select the last entry
[ENTER]	Open the selected share, directory, or file
[BACKSPACE]	Return to the parent
[/]	Open the command prompt
[d]	Download the selected file
[SUPPR]	Delete the selected file after confirmation
[h]	Display keyboard and command help
[q]	Quit
[r]	Refresh the current listing
[m]	Toggle between LIVE and OPSEC modes
[n]	Jump to the next highlighted /grep match in a file preview

Command prompt

Press [/] in the browser or file viewer, then enter one of these commands.

Command	Description
/get, /download, or /dl	Download the selected file, or the open file when used from the viewer.
/get <filename>	Download a named file from the current remote directory.
/put <local-path>	Upload a local file to the current remote directory. Quote paths containing spaces.
/filter <pattern>	Filter the current listing using a case-insensitive regular expression or glob.
/filter	Clear the active listing filter.
/refresh	Refetch the current listing and replace its cached snapshot.
/mode live, /mode opsec	Switch browser mode without reconnecting.
/grep <regex>	Highlight case-insensitive regex matches; the active match uses a distinct color.
/grep	Clear file-preview match highlighting.
/tree	Recursively list files below the current share and directory in an interactive tree view.
/tree_download	Recursively download files below the current share and directory.
/rm [<filename>]	Delete the selected or open file when no filename is given, or delete a named file. These commands do not delete directories.
/mkdir <directory>	Create a directory inside the current remote directory.
/rmdir [<directory>]	Remove the selected empty directory when no name is given, or remove a named empty directory.
/help	Display keyboard shortcuts and available commands.
/exit or /quit	Exit SMBLoot from any view.
/download <filename>	Alias for /get.
/dl <filename>	Alias for /get.
/upload <local-path>	Alias for /put.
/delete [<filename>]	Alias for /rm.

Autocomplete: Press [TAB] while entering a download, upload, file-delete, or /rmdir command to complete remote filenames, remote directories, or local paths.

Tree view keys

Key	Action
[UP] or [k]	Select the previous file
[DOWN] or [j]	Select the next file
[PAGE UP] / [PAGE DOWN]	Move the selection by one screen
[HOME] or [g]	Select the first file
[END] or [G]	Select the last file
[ENTER]	Open the selected file
[d]	Download the selected file
[SUPPR]	Delete the selected file after confirmation
[/]	Open the command prompt; /get, /download, or /dl downloads the selected file
[h]	Display keyboard and command help
[ESC], [BACKSPACE], or [q]	Return to the browser

Filter Examples

Glob example:

/filter *.csv

Regex example that displays entries except names ending in .csv or .pdf:

/filter (?i)^(?!.*\.(?:csv|pdf)$).*$

Clear the current filter:

/filter

Testing

Install the runtime dependency, then run the unit-test suite:

uv run --with 'impacket>=0.13.1' python -m unittest discover --start-directory tests --verbose
# or
python -m pip install --requirement requirements.txt
python -m unittest discover --start-directory tests --verbose

GitHub Actions runs the same tests and Ruff checks for every push and pull request.

Pre-push hook

Install the repository hook with either prek (recommended) or pre-commit:

uv tool install prek
prek install

Alternatively:

uv tool install pre-commit
pre-commit install

The hook checks Ruff linting and formatting across the complete repository, then runs the full unit-test suite before every push. If the hook was installed before this configuration was added, run prek install or pre-commit install again to install the pre-push hook.

Run all checks manually with:

prek run --all-files
# or: pre-commit run --all-files