> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/smb-discovery/smbmap.md). # SMBMap **SMBMap** allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and is intended to simplify searching for potentially sensitive data across large networks. Features: Pass-the-Hash Support File upload/download/delete Permission enumeration (writable share, meet Metasploit) Remote Command Execution Distrubted file content searching (beta!) File name matching (with an auto downoad capability) Host file parser supports IPs, host names, and CIDR SMB sigining detection Server version output Kerberos support! ## List available shares ### Without credentials To list available shares without credentials (as an anonymous user). \ By default SMBMap uses the **Guest** user. ```bash smbmap -H $TARGET_IP -u null -p null ```
Example run ```bash ┌──(kali㉿kali)-[/mnt/hgfs/OffSec_PG/PG_Practice/Compromised] └─$ smbmap -H $TARGET_IP -u null -p null ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap [*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 0 authenticated session(s) [+] IP: 192.168.129.152:445 Name: 192.168.129.152 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC Scripts$ READ ONLY Users$ READ ONLY [*] Closed 1 connections ```
### With credentials To list available shares as `Administrator` and blank/no password ```bash smbmap -H $TARGET_IP -u Administrator -p '' ```
Example run ```bash ┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Starting_Point/Tier_1/Tactics] └─$ smbmap -H $TARGET_IP -u Administrator -p '' ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap [*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) [+] IP: 10.129.23.151:445 Name: 10.129.23.151 Status: ADMIN!!! Disk Permissions Comment ---- ----------- ------- ADMIN$ READ, WRITE Remote Admin C$ READ, WRITE Default share IPC$ READ ONLY Remote IPC [*] Closed 1 connections ```
## List files recursively To list all files in a share recursively ```bash smbmap -H $TARGET_IP -r --depth 5 ``` ```bash smbmap -H $TARGET_IP -u Guest --no-pass -r --depth 5 ``` Then we can download a specific file without specifying the path like this ```bash smbmap -H $TARGET_IP -R -A -q ``` ## Command execution To execute a command, in this case `ipconfig /all` ```bash smbmap -H $TARGET_IP -u Administrator -p '' -x 'ipconfig /all' ```
Example run ```bash ┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Starting_Point/Tier_1/Tactics] └─$ smbmap -H $TARGET_IP -u Administrator -p '' -x 'ipconfig /all' ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com https://github.com/ShawnDEvans/smbmap [*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) [|] Executing wmi command, hang tight... [*] Host: 10.129.23.151 Windows IP Configuration Host Name . . . . . . . . . . . . : Tactics Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : .htb Ethernet adapter Ethernet0: Connection-specific DNS Suffix . : .htb Description . . . . . . . . . . . : vmxnet3 Ethernet Adapter Physical Address. . . . . . . . . : 00-50-56-94-0E-45 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 10.129.23.151(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.0.0 Lease Obtained. . . . . . . . . . : Saturday, August 9, 2025 2:20:22 AM Lease Expires . . . . . . . . . . : Saturday, August 9, 2025 3:50:21 AM Default Gateway . . . . . . . . . : 10.129.0.1 DHCP Server . . . . . . . . . . . : 10.129.0.1 DNS Servers . . . . . . . . . . . : 1.1.1.1 1.0.0.1 NetBIOS over Tcpip. . . . . . . . : Enabled [*] Closed 1 connections ```
## Usage information
smbmap -h ```bash ┌──(kali㉿kali)-[~/Desktop] └─$ smbmap -h usage: smbmap [-h] (-H HOST | --host-file FILE) [-u USERNAME] [-p PASSWORD] [-s SHARE] [-d DOMAIN] [-P PORT] [-v] [--admin] [-x COMMAND] [--mode CMDMODE] [-L | -R [PATH] | -r [PATH]] [-A PATTERN | -g] [--dir-only] [--no-write-check] [-q] [--depth DEPTH] [--exclude SHARE [SHARE ...]] [-F PATTERN] [--search-path PATH] [--search-timeout TIMEOUT] [--download PATH] [--upload SRC DST] [--delete PATH TO FILE] [--skip] SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com options: -h, --help show this help message and exit Main arguments: -H HOST IP of host --host-file FILE File containing a list of hosts -u USERNAME Username, if omitted null session assumed -p PASSWORD Password or NTLM hash -s SHARE Specify a share (default C$), ex 'C$' -d DOMAIN Domain name (default WORKGROUP) -P PORT SMB port (default 445) -v Return the OS version of the remote host --admin Just report if the user is an admin Command Execution: Options for executing commands on the specified host -x COMMAND Execute a command ex. 'ipconfig /all' --mode CMDMODE Set the execution method, wmi or psexec, default wmi Shard drive Search: Options for searching/enumerating the share of the specified host(s) -L List all drives on the specified host -R [PATH] Recursively list dirs, and files (no share\path lists ALL shares), ex. 'C$\Finance' -r [PATH] List contents of directory, default is to list root of all shares, ex. -r 'C$\Documents and Settings\Administrator\Documents' -A PATTERN Define a file name pattern (regex) that auto downloads a file on a match (requires -R or -r), not case sensitive, ex '(web|global).(asax|config)' -g Make the output grep friendly, used with -r or -R (otherwise it outputs nothing) --dir-only List only directories, ommit files. --no-write-check Skip check to see if drive grants WRITE access. -q Quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when performing a search (-A). --depth DEPTH Traverse a directory tree to a specific depth. Default is 5. --exclude SHARE [SHARE ...] Exclude share(s) from searching and listing, ex. --exclude ADMIN$ C$' File Content Search: Options for searching the content of files (must run as root) -F PATTERN File content search, -F '[Pp]assword' (requires admin access to execute commands, and PowerShell on victim host) --search-path PATH Specify drive/path to search (used with -F, default C:\Users), ex 'D:\HR\' --search-timeout TIMEOUT Specifcy a timeout (in seconds) before the file search job gets killed. Default is 300 seconds. Filesystem interaction: Options for interacting with the specified host's filesystem --download PATH Download a file from the remote system, ex.'C$\temp\passwords.txt' --upload SRC DST Upload a file to the remote system ex. '/tmp/payload.exe C$\temp\payload.exe' --delete PATH TO FILE Delete a remote file, ex. 'C$\temp\msf.exe' --skip Skip delete file confirmation prompt Examples: $ smbmap -u jsmith -p password1 -d workgroup -H 192.168.0.1 $ smbmap -u jsmith -p 'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d' -H 172.16.0.20 $ smbmap -u 'apadmin' -p 'asdf1234!' -d ACME -h 10.1.3.30 -x 'net group "Domain Admins" /domain' ```
## Resources Smbmap - Github: Smbmap - Kali Tools: Server Message Block - Wikipedia: