smbsniff(1)

NAME

smbsniff - sniff your network and capture the files being shared and documents being printed through the SMB/CIFS protocol to your disk.

SYNOPSIS

smbsniff [options]

Options [-d device] [-f dump_log_file] [-h help]

DESCRIPTION

smbsniff is SMB protocol sniffer. It captures the files being transmitted and the documents being printed.

smbsniff can extract the information using a network device (autodetected or specified) or a dump file created by tcpdump (don't forget the -s option. It's very important that you specify -s 1518 on an ethernet network because this program uses the size specified by the SMB to write data so if a captured packet is missing any data the program will either replace the data by garbage or core-dump in a very messy way). To capture data from a network you will need to be root as the program relies on the libpcap.

All data captured is stored in the file name transmitted by the SMB request to wich a -XX is appended (00 <= XX <= 99). This is done to avoid files having the same name to smash each other (and to make my early testings testing more easy).

OPTIONS

[-d device] You can specify a network device from wich the libpcap will capture data. Default behaviour is to grab data from the network and autodetect the device.

[-f file] Specify a log file, created by tcpdump, from wich to capture the passwords, challenges and accounts. (Once again DO NOT FORGET THE -S OPTION WHEN USING TCPDUMP)

KNOWN BUGS

The files created might be smaller or larger (?!) than the original ones. Partial solution is tunning the pcap_open_live() to_ms parameter.

Program was tested under i386 linux (redhat and slackware) and FreeBSD and sparc SunOS 5.6 (well not quite yet, but hopefully soon :). You might want to check the byte ordering of your system

DISCLAIMER

The code is ugly / heavy / not thoroughly tested / lacks bounbadry checks! / lame. I did not realize the complexity of this protocol until it was too late :). This program was designed to learn about SMB/CIFS and m$ networks, please use in a responsible manner. Once again this comes with no warranty of any kind.

AUTHOR

smbsniff was written by Frederic Lavecot <Frederic.Lavecot@hsc.fr> during his internship for Herve Schauer Consultants <http://www.hsc.fr>. Thank you to Herve Schauer for letting me work on this.