Information Gathering
SMBClient is an FTP-like command-line client from the Samba suite for accessing SMB/CIFS file shares on Windows, Samba, and NAS devices. It lets you list shares, browse directories, download and upload files, and test anonymous or authenticated access on remote systems over SMB ports 139 and 445. Use it after Nmap discovers open SMB ports to enumerate shares, test permissions, and transfer files during authorized security assessments.
sudo apt install smbclient
smbclient //<host>/<share> [options]
SMBClient is an interactive command-line utility included in the Samba suite that provides FTP-like access to SMB/CIFS (Server Message Block/Common Internet File System) resources on Windows, Samba, and other SMB-compatible servers. It enables users to browse shared folders, list directory contents, and transfer files to and from remote systems over the SMB protocol.
The tool operates by establishing SMB sessions to target hosts on ports 139 (NetBIOS Session Service) or 445 (Direct Host SMB), authenticating with optional credentials, and providing an interactive shell where users can execute file operations. SMBClient supports anonymous (null session) access for testing misconfigured shares, authenticated access with username/password combinations, and domain authentication for enterprise Active Directory environments.
For penetration testers and security auditors, SMBClient is essential for verifying share access permissions, testing anonymous login configurations, downloading files for analysis, and assessing SMB security posture. Unlike automated enumeration tools, SMBClient provides hands-on interactive access that allows deep inspection of share contents, permission testing, and file-level operations critical for comprehensive security assessments.
smbclient -L //192.168.1.1 -NList shares anonymously — see all available shares on the target without entering any credentialssmbclient //192.168.1.1/share -U username%passwordConnect to a share with username and password — access a specific shared folder using credentialssmbclient //192.168.1.1/share -NAnonymous connection — connect to a shared folder without a password to test for misconfigured sharesget filenameDownload file (interactive) — retrieve a single file from the share after connectingput filenameUpload file (interactive) — transfer a local file to the share after connectingsmbclient -L //192.168.1.1 -U domain\user%passwordDomain authenticated listing — list shares using Active Directory domain credentialssmbclient //192.168.1.1/share -c 'ls'Non-interactive directory listing — list share contents from the command line without entering the shellsmbclient //192.168.1.1/share -U user -c 'get remote.txt local.txt'Direct file download — download a specific file without entering the interactive shellsmbclient //192.168.1.1/share -U user -c 'put local.txt remote.txt'Direct file upload — upload a specific file without entering the interactive shellsmbclient //192.168.1.1/share -N -c 'recurse; ls'Recursive directory listing — list all files and subdirectories recursively using the -c flagsmbclient //192.168.1.1/share -N -c 'tarmode archive compress; tar c files.tar *'Recursive tar download — archive the entire share contents into a local tar file for bulk extractionsmbclient -L //192.168.1.1 -N -d 3Debug connection — list shares with debug level 3 to see detailed protocol and connection informationsmbclient //192.168.1.1/share -U user -m SMB2Force SMB2 protocol — explicitly connect using the SMB2 protocol instead of auto-negotiatingsmbclient //192.168.1.1/share -U user -W WORKGROUPSet workgroup — connect to a share using a specific Windows workgroup or domain namesmbclient //192.168.1.1/share -N -c 'mask *.log; mget *'Bulk download with mask — download all files matching a specific pattern from the shareVerify whether SMB shares are accessible anonymously or with provided credentials, testing for misconfigurations that expose sensitive data to unauthorized users.
Download files from accessible shares during penetration tests to demonstrate data exposure risks and assess the sensitivity of information stored on network shares.
After Enum4Linux or NBTScan discovers shares, use SMBClient to manually verify access permissions, test write capabilities, and confirm share-level security controls.
Access compromised file shares during incident response to recover deleted files, examine staged attacker data, or verify backup integrity on network storage.
Interactive exploration of discovered SMB shares to understand their contents, identify sensitive documents, and map the data landscape of Windows networks.
Use non-interactive mode (-c flag) to script file downloads, uploads, and directory listings for automated security testing pipelines and batch operations.
SMBClient is interactive with an FTP-like shell for manual exploration; SMBMap is non-interactive and optimized for automated enumeration and bulk downloads. Use SMBClient for hands-on testing, SMBMap for scripting.
Yes, SMBClient supports SMB2 and SMB3 including encryption. Use '-m SMB3' to force SMB3 protocol negotiation. Encryption protects credentials and data in transit on untrusted networks.
Use '--password=ntlm_hash' instead of a plaintext password: 'smbclient //10.10.10.10/share -U administrator --password=aad3b435b51404ee...'. This authenticates using the NTLM hash directly, useful when you have extracted hashes but not cracked them.
NT_STATUS_ACCESS_DENIED (wrong perms), NT_STATUS_LOGON_FAILURE (bad creds), NT_STATUS_BAD_NETWORK_NAME (wrong share), connection refused (port blocked/firewall). Debug with '-d 3' to see the full SMB exchange.
Yes. SMBClient is part of the Samba suite and comes pre-installed on Kali Linux. Verify with 'smbclient --version'. On other distributions, install via 'sudo apt install smbclient' or 'sudo dnf install samba-client'.
SMB Enumeration
Comprehensive SMB enumeration tool for extracting users, shares, groups, and policies from Windows systems.
SMB Enumeration
Next-generation Python 3 rewrite of Enum4linux with JSON export and improved performance.
NetBIOS Scanner
Fast NetBIOS scanner for discovering Windows hosts and their NetBIOS names, workgroups, and MAC addresses.
Network Scanner
Versatile network scanner for port discovery, service detection, and OS fingerprinting across networks.
Post-Exploitation
Post-exploitation tool for enumerating and attacking SMB services across large networks efficiently.
Password Attacks
Fast network brute-force tool for testing credentials against various services including SMB.
Post-Exploitation
Next-generation post-exploitation tool with modern Active Directory enumeration and attack capabilities.
The list command (-L) outputs a table with three columns: Sharename (the UNC name you connect to), Type (Disk for file shares, IPC for named pipes, Print for printers), and Comment (an optional description set by the administrator). An anonymous listing may show fewer shares than an authenticated one because Windows restricts null session visibility by default. Once connected, the smb: \> prompt indicates an active session. Directory listings (ls) show filenames, sizes in bytes, timestamps, and DOS attributes (A = Archive, D = Directory, R = Read-only, H = Hidden, S = System). Error messages include NT_STATUS_ACCESS_DENIED (share exists but you lack permission), NT_STATUS_LOGON_FAILURE (bad username or password), NT_STATUS_BAD_NETWORK_NAME (share name does not exist), and connection refused (SMB service is down or blocked). Use the -d flag (e.g., -d 3) for verbose debug output that reveals protocol negotiation details, authentication exchanges, and connection state.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.