smbmap

A Python SMB enumeration tool by Shawn Evans that lists share drives, drive permissions, and share contents — with upload/download, filename pattern matching, and remote command execution built in. Where smbclient is an interactive FTP-like client, smbmap is built for sweeping hosts and quickly answering “which shares can I read or write?”

Key options

Flag	Purpose
-H	IP address or host to enumerate
-u	Username (attempts a NULL session if omitted)
-p	Password or NTLM hash
-d	Domain or workgroup
-s	Share to enumerate (defaults to C$)
-r	Recursively list share contents (--depth N to limit)
-x	Execute a command on the server (requires appropriate privileges)
--download / --upload	Transfer files to/from the specified share
-A	Auto-download files matching a regex pattern

Example output

$ smbmap -H 192.168.86.214 -u Administrator -p asdf1234
[+] IP: 192.168.86.214:445   Name: shawnevans-pc.lan   Status: ADMIN!!!
    Disk                Permissions   Comment
    ----                -----------   -------
    ADMIN$              READ, WRITE   Remote Admin
    C$                  READ, WRITE   Default share
    IPC$                NO ACCESS     Remote IPC

The Permissions column is the payoff — writable shares like ADMIN$ map directly to %WINDIR% and enable binary-planting attacks (see exploit-windows-services). Passing an NTLM hash to -p enables pass-the-hash-style access without knowing the cleartext password.

Sources

• SMBMap
• MITRE ATT&CK T1135 — Network Share Discovery
• MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares

Related: smbclient, smbget, enum4linux, default-cifs-shares, exploit-windows-services