smbget

A wget-style SMB file-download utility from the Samba suite. Where smbclient is an interactive FTP-like client, smbget is a one-shot, scriptable downloader — the SMB analog of wget for pulling files off Windows and Samba shares from Linux.

Basic usage

smbget smb://$IP/$SHARE/$FILE -U $USER

Downloads $FILE from $SHARE at $IP.

Useful options:

Flag	Purpose
-R	Recursively download an entire directory (omit $FILE)
-U	Username; ${USER}%${PASSWORD} to embed a password
-w	Domain or workgroup
-a	Prompt for a password but keep it off the command line
-o	Write to a local file with a different name

Quirks vs smbclient

The semantics are annoyingly slightly different from smbclient:

• URI required — the target must be a full smb://host/share/path URI; smbclient’s //HOST/SHARE form is not accepted.
• No port specification — smbget connects on the standard SMB ports (445, then 139); there is no -p flag, which makes it awkward against targets on non-standard ports or through certain port-forward setups.
• No interactive mode — everything happens in one invocation, so it composes cleanly in loops and download-cradle style shell one-liners.

For bulk transfers, -R plus a share root is the quick way to mirror an exposed share during reconnaissance — pair it with smbmap (-A pattern auto-download) when you only want files matching names like password*, *.kdbx, or unattend.xml.

Sources

• smbget
• MITRE ATT&CK T1135 — Network Share Discovery

Related: smbclient, smbmap, enum4linux, default-cifs-shares