Skip to content

add --get_folder functionality#1190

Open
Marshall-Hallenbeck wants to merge 4 commits intomainfrom
feat/smb-get-folder
Open

add --get_folder functionality#1190
Marshall-Hallenbeck wants to merge 4 commits intomainfrom
feat/smb-get-folder

Conversation

@Marshall-Hallenbeck
Copy link
Copy Markdown
Collaborator

Description

Forking off this functionality from #1168

--get-folder SMB command — Downloads a remote directory from a share to a local destination. Supports --recursive for subdirectories and --ignore-empty-folders to skip empty directories. Includes path traversal protection via filename sanitization.

nxc/helpers/path.py — Path traversal sanitization for SMB filenames

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)
  • This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Testing environment:

Kali Linux (Debian-based)
Python 3.x with NetExec installed from source (I used Poetry, per norm)
Target: SMB share (I used Windows)

To test --get-folder:

nxc smb -u -p --share SYSVOL --get-folder '<remote_path>' '<local_dest>' --recursive

Screenshots (if appropriate):

Screenshots are always nice to have and can give a visual representation of the change.
If appropriate, include before and after screenshot(s) to show which results are to be expected.

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
  • I have performed a self-review of my own code (not an AI review)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@Marshall-Hallenbeck Marshall-Hallenbeck self-assigned this Apr 6, 2026
@Marshall-Hallenbeck Marshall-Hallenbeck added the enhancement New feature or request label Apr 6, 2026
@Marshall-Hallenbeck Marshall-Hallenbeck mentioned this pull request Apr 6, 2026
14 tasks
@Marshall-Hallenbeck
Copy link
Copy Markdown
Collaborator Author

@NeffIsBack as requested

Copy link
Copy Markdown
Member

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The forward slash path bug is still present 🥲 see review: #320 (comment)
Also silent is not applied when downloading a folder, see comment: #320 (review)

Image

Comment thread nxc/protocols/smb.py Outdated

def get_folder(self):
recursive = self.args.recursive
ignore_empty = getattr(self.args, "ignore_empty_folders", False)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be args.ignore_empty_folders

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call, it already has a default.

@Marshall-Hallenbeck
Copy link
Copy Markdown
Collaborator Author

Hmm I swear I fixed those, my bad, I'll go back and check, maybe I fixed it and then over-wrote it like a dumbass.

@NeffIsBack
Copy link
Copy Markdown
Member

Hmm I swear I fixed those, my bad, I'll go back and check, maybe I fixed it and then over-wrote it like a dumbass.

No worries :D

Add download_file(), download_folder(), and get_folder() methods to the
SMB protocol. Refactor get_file_single() to use download_file() with
automatic fallback from READ to READ/WRITE access on sharing violations.

New CLI args: --get-folder, --recursive, --ignore-empty-folders

Example: nxc smb target -u user -p pass --share SYSVOL --get-folder 'domain\Policies' ./output --recursive
@NeffIsBack
Copy link
Copy Markdown
Member

Was that an intended force push? Did something change that I should review?

@Marshall-Hallenbeck
Copy link
Copy Markdown
Collaborator Author

Was that an intended force push? Did something change that I should review?

lol no, was a rebase :P

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants