smbmap
Maps SMB share permissions across hosts and lets you list, download, upload, and search files. Tells you exactly what you can read and write on every share.
LevelBeginner. Use it once Nmap or enum4linux-ng shows SMB shares.
Know firstWhat an SMB share is, and the difference between read and write access.
You will learn tolist which shares you can read or write, browse and download files, and find credentials in them.
What is it?
smbmap is an SMB share enumerator that focuses on one thing: what can you access? While enum4linux-ng tells you what shares exist, smbmap tells you your exact permissions on each share: can you read it, write to it, both, or neither?
More importantly, smbmap lets you interact with shares. You can:
- List files recursively inside shares you can read
- Download specific files or entire directories
- Upload files to writable shares
- Search for files by name or pattern across shares
- Run a command on the host with
-x, which needs admin rights
SMB shares are one of the most common places to find credentials, configuration files, scripts, and sensitive documents during a pentest. A writable share can sometimes be used for code execution.
Run this first
Check what you can reach without credentials, then repeat with credentials when you have them.
bash: your first share check
# No credentials (a null session) $ smbmap -H 10.10.10.10 # With credentials $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!'
-His the target host.-u and -pare the username and password. Leave them out for a null session.
The output has one row per share with your permission on it: NO ACCESS, READ ONLY or READ, WRITE. Readable shares are where you look for files, and writable shares are a possible foothold. A plain run lists shares only; add -r to see the files inside.
When do you use it?
Reach for smbmap when
- You found port 445 open → check what shares you can access (null session or with creds)
- enum4linux found shares → use smbmap to check your actual READ/WRITE permissions
- You have valid credentials → map all accessible shares across the domain, look for sensitive files
- Looking for credential files → recursive search for
.xml,.ini,.txt,.cfgfiles containing passwords - Need to upload a payload → check which shares are writable
- Checking multiple hosts → smbmap can scan a range or a file of IPs
Understanding share permissions
smbmap output shows these permission levels:
| Permission | Meaning | What you can do |
|---|---|---|
READ ONLY | You can list and download files | Browse for creds, configs, scripts, documentation |
READ, WRITE | Full access: list, download, upload, delete | All of the above plus upload payloads, modify scripts |
NO ACCESS | Share exists but you can't access it | Nothing: try with different creds later |
WRITE ONLY | Can upload but not list (rare) | Drop files but can't confirm they're there |
Writable shares are high value
A writable share can mean: (1) Upload a web shell if it's a web root. (2) Drop a SCF/URL file for NTLM hash capture with Responder. (3) Replace a script that runs as a scheduled task. (4) Plant a DLL for DLL hijacking. Always note writable shares.
How to use it
Null session (no credentials)
bash: null session check
# Check share permissions with null session $ smbmap -H 10.10.10.10 # Sometimes you need to specify a null user explicitly $ smbmap -H 10.10.10.10 -u '' -p '' $ smbmap -H 10.10.10.10 -u 'guest' -p ''
Authenticated access
bash: with credentials
# With username/password $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' -d 'corp.local' # With NTLM hash (pass-the-hash) $ smbmap -H 10.10.10.10 -u 'administrator' -p 'aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f'
output: share permissions
[+] IP: 10.10.10.10:445 Name: dc01.corp.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share Department READ ONLY <-- readable! IPC$ READ ONLY Remote IPC IT READ, WRITE <-- writable! NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share
Listing files in a share
bash: list and browse shares
# List a share recursively (the default depth is 5 levels) $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' -r 'Department' # --depth changes how many levels -r descends (here 2 instead of the default 5) $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' -r 'Department' --depth 2 # Browse a subdirectory $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' -r 'Department/HR'
Downloading files
bash: download files
# Download a specific file $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' --download 'Department/HR/passwords.xlsx' # Search for interesting files across all readable shares $ smbmap -H 10.10.10.10 -u 'jsmith' -p 'Password123!' -r -A 'passw|cred|config|web\.config|\.xml|\.ini' # -A = auto-download files matching this regex pattern (requires -r). With no path, -r walks every readable share
Files to look for on shares
web.config: often contains database connection strings with passwords*.xml: Group Policy Preferences (GPP) files with encrypted passwords (crackable)*.ini,*.cfg: configuration files with credentials*.ps1,*.bat,*.vbs: scripts that often hardcode credentials*.kdbx: KeePass database filesunattend.xml,sysprep.xml: Windows deployment files with local admin passwords
smbmap vs enum4linux-ng
| Task | smbmap | enum4linux-ng |
|---|---|---|
| List shares | Yes, with permissions | Yes, names only |
| Check READ/WRITE access | Yes: this is its strength | No |
| Browse files in shares | Yes, recursive listing | No |
| Download files | Yes | No |
| Enumerate users | No | Yes (RID cycling + SAM) |
| Password policy | No | Yes |
| Group memberships | No | Yes |
Use both: enum4linux-ng for broad reconnaissance (users, groups, policy), smbmap for share-specific work (permissions, files, downloads).
Common mistakes
Things that go wrong
- Only checking null session: Most modern DCs block null sessions. Always re-check shares once you get valid credentials, you'll see far more
- Skipping SYSVOL/NETLOGON: These default shares often contain GPP XML files with encrypted passwords (decryptable with
gpp-decrypt), logon scripts with hardcoded creds, and Group Policy files - Not searching recursively: A plain run lists shares and your permissions, not files. Add
-rto list files, which descends 5 levels by default (--depthchanges that), because interesting files are often buried several directories deep. Older smbmap releases used-Rfor this, so checksmbmap -hon your version - Forgetting the domain flag: Some environments require
-d corp.localfor authentication to work - Ignoring writable shares: A writable share is a potential foothold. Can you drop a SCF file? Replace a script? Upload a web shell?
- Not trying guest access: Some shares allow the built-in
guestaccount even when null sessions fail
Check yourself
Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.
A plain smbmap run shows shares but no files. What do you add?
-r lists files recursively, 5 levels deep by default (--depth changes that). Older releases used -R for this.Why run smbmap again after you get valid credentials, even if the null session already worked?
Most modern domain controllers block null sessions, and an authenticated account sees far more shares and files than an anonymous one.
Which default domain shares often hold passwords, and in what form?
SYSVOL and NETLOGON. They often contain GPP XML files with encrypted passwords (decryptable with
gpp-decrypt), logon scripts with hardcoded credentials, and Group Policy files.What does a writable share give you to try?
It is a possible foothold. You could drop a file that makes users authenticate to you, replace a script someone runs, or upload a web shell if the share is served by a web server.
Every share says NO ACCESS but you know the account is valid. What might be missing?
The domain. Some environments need
-d corp.local for authentication to work.