smbmap — SMB Share Enumeration Reference
What is smbmap?
smbmap is a Python tool that enumerates SMB shares on a target, shows read/write permissions for each share, and can recursively list directories, search for specific files by name, download files, and even execute commands — all from a single command without entering an interactive shell.
OSCP use: Run smbmap immediately after finding port 445 open. It gives a fast permission map across all shares and tells you exactly what you can read or write — faster than smbclient for initial recon.
Syntax
smbmap [options] -H <target>📌 1) All Flags
| Flag | Description |
|---|---|
-H <host> | Target IP or hostname |
-u <user> | Username (default: empty string for null session) |
-p <pass> | Password |
-d <domain> | Domain / workgroup |
-s <share> | Target a specific share only |
-P <port> | Target port (default: 445) |
-L | List shares only (no content listing) |
-r [path] | Recursively list directory contents (default: root of each share) |
-R [path] | Same as -r but also follows symlinks |
-A <regex> | Download all files matching a regex pattern |
-q | Quiet — only print shares with read/write access |
--download <path> | Download a specific file (Share/path/file.txt) |
--upload <src> <dst> | Upload a local file to a remote path |
--delete <path> | Delete a remote file |
--no-write-check | Skip write permission test |
-x <cmd> | Execute a command on the target (requires admin) |
--admin | Show only admin shares |
--depth <N> | Limit recursive listing depth (default: 5) |
--exclude <share> | Exclude a share from the scan |
-t <sec> | Timeout (default: 10s) |
-v | Verbose output |
📌 2) Share Enumeration
Null / anonymous session
smbmap -H 10.10.10.10With credentials
smbmap -H 10.10.10.10 -u admin -p password
smbmap -H 10.10.10.10 -u admin -p password -d DOMAINPass-the-Hash
smbmap -H 10.10.10.10 -u Administrator -p 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'Sample output
[+] IP: 10.10.10.10:445 Name: target
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
Backups READ ONLY
📌 3) Recursive Directory Listing
# List all contents recursively across all readable shares
smbmap -H 10.10.10.10 -r
# Recurse into a specific share
smbmap -H 10.10.10.10 -r Backups
# Recurse into a subdirectory
smbmap -H 10.10.10.10 -r "Backups/IT"
# Limit recursion depth
smbmap -H 10.10.10.10 -r --depth 3
# With credentials
smbmap -H 10.10.10.10 -u admin -p password -r📌 4) File Search
Search for files by regex across all readable shares:
# Find any file with "password" in the name
smbmap -H 10.10.10.10 -A "password"
# Find config or XML files
smbmap -H 10.10.10.10 -A "\.config$|\.xml$|\.ini$"
# Find anything with "backup" in the name
smbmap -H 10.10.10.10 -A "backup" -q
# With credentials
smbmap -H 10.10.10.10 -u admin -p password -A "password|secret|cred"📌 5) File Download & Upload
# Download a specific file
smbmap -H 10.10.10.10 -u admin -p password --download "Backups/IT/credentials.txt"
# Download all matching files
smbmap -H 10.10.10.10 -u admin -p password -A "\.txt$"
# Upload a file (check write permission first)
smbmap -H 10.10.10.10 -u admin -p password --upload /home/kali/shell.exe "C$/Temp/shell.exe"
# Delete a file
smbmap -H 10.10.10.10 -u admin -p password --delete "Backups/old_backup.zip"📌 6) Command Execution
Requires admin-level access (maps to ADMIN$):
# Run a command and get output
smbmap -H 10.10.10.10 -u Administrator -p password -x "ipconfig"
smbmap -H 10.10.10.10 -u Administrator -p password -x "whoami"
smbmap -H 10.10.10.10 -u Administrator -p password -x "net localgroup administrators"📌 7) Subnet / Multiple Hosts
# Scan an entire subnet
smbmap -H 10.10.10.0/24
# Read targets from file
smbmap -H targets.txt
# Quiet — only show accessible shares
smbmap -H 10.10.10.0/24 -q📌 Quick OSCP Cheat Sheet (Copy/Paste)
# Anonymous scan — see what's open
smbmap -H TARGET
# Authenticated — full permission map
smbmap -H TARGET -u username -p password
# Recursive listing on all shares
smbmap -H TARGET -u username -p password -r
# Hunt for interesting files
smbmap -H TARGET -u username -p password -A "password|credential|secret|config|backup"
# Download a file
smbmap -H TARGET -u username -p password --download "ShareName/path/file.txt"
# Pass-the-Hash
smbmap -H TARGET -u Administrator -p 'LM:NTLM'