smbmap: SMB share enumeration & permissions

Where smbclient gives you an interactive session, smbmap is built for fast one-shot queries: what shares exist, what can I read or write, and can I execute a command through valid credentials.

Enumeration

smbmap -H <target_ip>                                  # anonymous enumeration
smbmap -u <user> -p <password> -H <target_ip>           # authenticated enumeration
smbmap -u <user> -p <password> -H <target_ip> -r 'C$'   # recursive listing of a share
smbmap -u <user> -p <password> -H <target_ip> -L        # list all drives
smbmap -u <user> -p <password> -H <target_ip> --check-write

Execution and file transfer

smbmap -u <user> -p <password> -H <target_ip> -x 'ipconfig'          # RCE via a writable share
smbmap -u <user> -p <password> -H <target_ip> --upload '/local/file' 'C$\file'
smbmap -u <user> -p <password> -H <target_ip> --download 'C$\file'

Flag	Meaning
-H	Target host
-u / -p	Username / password
-r	Recursive listing of a share
-L	List all drives
--check-write	Test for writable shares
-x	Execute a command
--upload / --download	Transfer files

Related

• SMB & NetBIOS enumeration: the full workflow these tools plug into
• SMB exploitation: turning access into a shell
• rpcclient: users and groups over RPC
• enum4linux: broad first pass on the same target