smbclient
An FTP-like command-line client for accessing SMB/CIFS resources, part of the Samba suite. The standard tool for interactively browsing Windows and Samba shares from Linux — both for legitimate file access and for reconnaissance during a penetration test.
Connecting to a share
smbclient //$IP/$SHARE -U $USER -p $PORTKey options:
| Flag | Purpose |
|---|---|
-I | IP address to connect to (bypasses NetBIOS name resolution) |
-U | Username for the connection; specify ${USER}%${PASSWORD} to include a password |
-N | Attempt to connect with no password (anonymous / null session) |
-W | Domain or workgroup for the connection |
-p | Connect on a non-standard port (only needed when not 445) |
-c | Execute the supplied command string non-interactively (e.g., -c 'get file.txt') |
If -U is omitted, smbclient defaults to the current local username — usually not what you want against a target. The interactive interface mirrors old-school ftp clients (ls, get, put, mget, prompt).
Reconnaissance — listing shares
smbclient -L $SERVER_NAME -I $IP_ADDRESS$SERVER_NAME is the machine’s NetBIOS name, discoverable with enum4linux (or nmblookup). Anonymous share listing (-N) tests for a null session.
For automated share-permission enumeration at scale, use smbmap instead; for wget-style one-shot downloads from a known share path, use smbget; to spray credentials across the whole subnet at once, use crackmapexec.
Sources
- Samba — Opening Windows to a Wider World
- smbclient(1) — Samba man page
- MITRE ATT&CK T1135 — Network Share Discovery
- MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares
Related: enum4linux, smbmap, default-cifs-shares, ftp, ntlm-relay-attacks, nbtscan, nfs