Why would a penetration tester need to set up an anonymous SMB share on a Windows system during an internal network test?

Anonymous SMB shares serve as a convenient data transfer channel and are often used as payload download URLs during vulnerability exploitation. For instance, during attacks exploiting [CVE-2021-1675](/news/penetration-techniques-enabling-anonymous-access-shares-on-windows-systems-via-command-line) or [CVE-2021-34527](/news/penetration-techniques-enabling-anonymous-access-shares-on-windows-systems-via-command-line), having an anonymous share allows the target to fetch malicious files without authentication. This technique complements other methods like [accessing internal file shares via Exchange ActiveSync](/news/penetration-techniques-accessing-internal-file-shares-via-exchange-activesync) for lateral movement.