GO KALI FREE

SMBMap

Information Gathering

Beginnermedium risk

SMBMap allows users to flash out Samba share drives across entire domains, mapping access rights, folder structural read/write lists, file downloads, and upload tests.

Installation

sudo apt install smbmap

Basic Syntax

smbmap -H <target>

Quick Facts

Full Name
SMBMap
License
GPLv3
Author
Shawn Evans
Written In
Python
Platforms
Linux, macOS
Category
SMB Enumeration
Protocol
SMB/CIFS

Tool Overview

SMBMap is a tool for enumerating Samba shared drives across entire domains. It can list shares, check read/write permissions, download files, and test for null session access on Windows and Samba servers.

SMBMap automates the process of discovering and testing SMB shares across networks. Instead of manually connecting to each share, SMBMap scans entire subnets and provides a comprehensive view of accessible shares and their permissions.

The tool is essential for penetration testers assessing Windows environments. It quickly identifies misconfigured shares, weak permissions, and sensitive files that could lead to further compromise of the network.

Common Commands

smbmap -H 192.168.1.1Null session share check - Identify permissions allowed to public unauthenticated users
smbmap -H 192.168.1.1 -u User -p PasswordAuthenticated check - Enumerate accessible shares using valid target user credentials
smbmap -H 192.168.1.1 -u user -p passAuthenticated listing
smbmap -H 192.168.1.1 -u user -p pass -r shareList files in share
smbmap -H 192.168.1.1 -u user -p pass --download share/file.txtDownload file
smbmap -H 192.168.1.1 -u user -p pass -x "ipconfig"Execute command
smbmap -H 192.168.1.100List shares and permissions
smbmap -H 192.168.1.100 -u admin -p passAuthenticated share listing
smbmap -H 192.168.1.100 -u admin -p pass -RRecursive directory listing
smbmap -H 192.168.1.100 -u admin -p pass -r shareList specific share
smbmap -H 192.168.1.100 -u admin -p pass -d share -f file.txtDownload file from share
smbmap -H 192.168.1.100 -u admin -p pass -d share --upload file.txt /share/Upload file to share
smbmap -H 192.168.1.100 -u admin -p pass -x 'dir'Execute command via share
smbmap -H 192.168.1.100 --share-file 'file.txt'Search for specific file
smbmap -H 192.168.1.100 -u admin -p pass -g groups.txtMap group shares

Step-by-Step Guide

  1. 1Attempt an unauthenticated null session listing as a baseline
  2. 2Supply valid username and password pairs if you have discovered them
  3. 3Map out which directories offer read or write permissions
  4. 4Navigate through the folder structures of shares marked as accessible
  5. 5Pull down any files that look relevant to your security audit

Warnings

Use Cases

Share Enumeration

Discover all SMB shares on a network and list their contents.

Permission Testing

Check read/write permissions on discovered shares.

Null Session Detection

Test for unauthenticated access to SMB shares.

File Discovery

Recursively list files and identify sensitive documents.

File Transfer

Download and upload files on accessible shares.

Key Features

Related Tools

SMBClient

Information Gathering

Interactive SMB client for manual share access.

Enum4linux

Information Gathering

Comprehensive SMB enumeration tool.

Frequently Asked Questions

What is SMBMap used for?

SMBMap is used for enumerating Samba/SMB shared drives across domains. It lists shares, checks read/write permissions, downloads files, and tests access including null sessions on Windows and Samba servers.

Does SMBMap support null sessions?

Yes, SMBMap can test for null session access, which allows unauthenticated users to list shares and files on misconfigured Windows or Samba servers.

Can SMBMap upload files?

Yes, SMBMap supports file upload to shares where you have write permissions, making it useful for testing write access during penetration tests.

How is SMBMap different from SMBClient?

SMBMap automates share enumeration across entire networks, while SMBClient provides interactive access to individual shares. SMBMap is better for discovery; SMBClient for manual interaction.

How do I install SMBMap?

Install SMBMap using: sudo apt install smbmap on Kali Linux. On other systems, clone from GitHub and install dependencies: git clone https://github.com/ShawnDEvans/smbmap && cd smbmap && pip install -r requirements.txt.

How do I use SMBMap for share enumeration?

Run smbmap -H 192.168.1.1 to list all shares on a target. Use -u user -p pass for authenticated enumeration, and -r sharename to list specific share contents.

What are the most common SMBMap commands?

Common commands include: smbmap -H target (list shares), smbmap -H target -u user -p pass (authenticated), smbmap -H target -r share (list files), smbmap -H target --download share/file.txt (download).

How do I test for null sessions with SMBMap?

Run smbmap -H target -G to test for guest/null session access. If successful, you can enumerate shares without credentials, indicating a security misconfiguration.

How does SMBMap compare to enum4linux?

SMBMap focuses on share enumeration and file operations. enum4linux provides deeper user enumeration, policy information, and group details. Use both for comprehensive SMB assessment.

Is SMBMap legal to use?

SMBMap itself is legal software. However, accessing SMB shares without permission from the owner may violate laws. Always obtain written authorization before testing SMB configurations.

How do I download files with SMBMap?

Use the --download flag: smbmap -H target -u user -p pass --download sharename/filename.txt. This downloads the specified file to your local machine.

How do I upload files with SMBMap?

Use the --upload flag: smbmap -H target -u user -p pass --upload local.txt sharename/upload.txt. This uploads a local file to the specified share.

What is the -R flag in SMBMap?

The -R flag performs recursive listing of all shares, showing the complete directory tree including subdirectories. This is useful for finding sensitive files nested in deep folder structures.

Why is SMBMap not finding shares?

Ensure the target has SMB enabled (port 445 open). Try without credentials first, then with valid domain credentials. Check if SMBv1 is disabled, which may affect older SMBMap versions.

How do I execute commands with SMBMap?

Use the -x flag to execute commands: smbmap -H target -u user -p pass -x "ipconfig". This executes the command on the target system through SMB.

What output does SMBMap provide?

SMBMap output shows share names, permissions (read/write), file listings, and directory structures. Authenticated scans provide detailed file trees and access levels for each share.

How do I scan multiple hosts with SMBMap?

Use CIDR notation: smbmap -H 192.168.1.0/24 to scan an entire subnet, or -H target1,target2 for specific hosts. SMBMap will enumerate shares on all specified targets.

What is SMBMap's -G flag?

The -G flag tests for guest/null session access. It attempts to connect without credentials and reports if guest access is allowed, indicating a potential security issue.

Tags

#smb#network#enumeration#file-access

Output Explanation

SMBMap output lists SMB shares along with their permissions (read/write), file listings, and directory structures. Authenticated scans show accessible shares with full file trees. Error messages indicate permission levels and access restrictions on each share.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.