impacket-ntfs-read

View documentation for the original command

$ tldr ntfs-read.py

impacket-ntfs-read [options] <smbserver> <share> [<outputfile>]

-h, --help
    Show help message and exit.


-debug
    Turn DEBUG output ON for verbose logging.


-hashes <LMHASH:NTHASH>
    Use NTLM hashes for authentication instead of password.


-no-pass
    Don't prompt for password (uses NTLM anonymously or from context).


-k
    Use Kerberos authentication from ccache (KRB5CCNAME).


-aesKey <hex key>
    AES key (128/256 bits) for Kerberos AES encryption.


-dc-ip <ipaddress>
    IP of domain controller (overrides FQDN resolution).


-target-ip <ipaddress>
    IP of target host (useful if NetBIOS name unresolvable).

impacket-ntfs-read is a tool from the Impacket suite designed to extract files from NTFS filesystems shared via SMB/CIFS on Windows targets. It bypasses common restrictions such as file locks (e.g., pagefile.sys, hiberfil.sys) and some ACL denials by directly accessing raw NTFS data streams using SMB2/3 FSCTL operations. This makes it invaluable for penetration testing, red teaming, and digital forensics when physical access is unavailable.

The tool authenticates to the target using NTLM or Kerberos, mounts the share, and reads the specified file or directory contents. If no output file is provided, it dumps to stdout. It excels at retrieving system files that are otherwise inaccessible remotely, like registry hives ($SYSTEM), SAM databases, or memory dumps.

Usage typically involves domain credentials: DOMAIN/USER:PASSWORD@TARGET_IP. It supports pass-the-hash and Kerberos tickets, aligning with Impacket's protocol implementation focus.

Requires valid SMB credentials and share access (e.g., ADMIN$ or C$). May trigger EDR/AV detection on modern Windows. Fails on non-NTFS filesystems or SMB1-only setups. Output file overwrites without warning.

Dump pagefile:
impacket-ntfs-read -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'DOMAIN/administrator@192.168.1.100' C$ 'pagefile.sys' ./pagefile.sys

Read registry hive:
impacket-ntfs-read user:pass@target SYSTEM32/config/SAM ./SAM

<domain/>username[:password]@<machinename_or_ip>
Supports pass-the-hash and Kerberos.

smbclient(1), mount.cifs(8), impacket-smbclient