smbclient is part of the official Samba software suite and provides an FTP-like command-line client for accessing SMB/CIFS shares on Windows and Samba servers. Unlike higher-level wrapper tools such as enum4linux, smbclient gives direct, interactive access to a target’s file-sharing service: listing shares, browsing directories, uploading/downloading files, and even sending old-style WinPopup messages. Because it is the reference SMB client shipped with Samba, it is extremely reliable and supports the full range of SMB dialects (SMB1 through SMB3).
In an enumeration context, smbclient is typically used to:
- List all shares exposed by a host (
-L) - Connect to a specific share and browse its directory tree interactively
- Test for null-session (anonymous) access
- Download interesting files found during enumeration
- Confirm findings from other tools like
enum4linux/smbmap
Installation
# Kali Linux (preinstalled as part of smbclient/samba-client package)
sudo apt update
sudo apt install smbclient -y
# Verify
smbclient --version
which smbclient
Syntax
smbclient //<server>/<share> [password] [options]
smbclient -L //<server> [options]
Command-Line Options
| Option | Description |
|---|---|
-L, --list | List available shares on the host instead of connecting to one |
-U username[%password] | Specify username (and optionally password) |
-N, --no-pass | Attempt connection with no password (null session) |
-I, --ip-address | Specify IP address to connect to explicitly |
-p, --port | Specify port to connect on (default 445) |
-W, --workgroup | Set workgroup/domain name |
-m, --max-protocol | Set maximum SMB protocol version to negotiate (e.g., SMB3) |
-c, --command | Execute semicolon-separated commands and exit (non-interactive) |
-g, --grepable | Produce grepable output for -L |
-k, --kerberos | Use Kerberos authentication |
-A, --authentication-file | Read username/password/domain from a file |
-t, --timeout | Set connection timeout in seconds |
-d, --debuglevel | Set debug/verbosity level (0–10) |
--pw-nt-hash | Supply an NT hash instead of a plaintext password (pass-the-hash) |
Interactive shell commands (once connected to a share):
| Command | Description |
|---|---|
ls / dir | List files in current remote directory |
cd <dir> | Change remote directory |
lcd <dir> | Change local directory |
get <file> | Download a file |
mget <pattern> | Download multiple files matching a pattern |
put <file> | Upload a file |
mput <pattern> | Upload multiple files |
mkdir <dir> | Create a remote directory |
rmdir <dir> | Remove a remote directory |
del <file> | Delete a remote file |
recurse | Toggle recursive mode for mget/mput |
prompt | Toggle interactive prompting for mget/mput |
more <file> | View a file’s contents via pager |
exit / quit | Close the connection |
Basic Usage
List all shares on a target using a null session:
smbclient -L //192.168.56.101/ -N
Expected output:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
tmp Disk oh noes!
opt Disk
IPC$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian))
ADMIN$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian))
Server Comment
--------- -------
METASPLOITABLE metasploitable server (Samba 3.0.20-Debian)
Workgroup Master
--------- -------
WORKGROUP METASPLOITABLE
Practical Examples
Example 1 — Anonymous share listing
smbclient -L //192.168.56.101 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
tmp Disk oh noes!
Example 2 — Connect to a share interactively
smbclient //192.168.56.101/tmp -N
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \>
Example 3 — List directory contents once connected
smb: \> ls
. D 0 Wed Jul 15 05:23:11 2026
.. D 0 Wed Jul 15 05:23:11 2026
vulnerable.jpg N 214233 Sun Jun 1 12:00:00 2026
notes.txt N 42 Wed Jul 15 05:23:11 2026
9846680 blocks of size 1024. 5877684 blocks available
Example 4 — Download a file of interest
smb: \> get notes.txt
getting file \notes.txt of size 42 as notes.txt (0.5 KiloBytes/sec)
Example 5 — Recursively download an entire share
smbclient //192.168.56.101/tmp -N -c "recurse ON; prompt OFF; mget *"
getting file \notes.txt of size 42 as notes.txt
getting file \subdir\backup.zip of size 10240 as subdir/backup.zip
Example 6 — Authenticated connection with credentials
smbclient //192.168.56.101/opt -U msfadmin%msfadmin
Try "help" to get a list of possible commands.
smb: \>
Example 7 — Grepable share listing for scripting
smbclient -L //192.168.56.101 -N -g
Disk|print$|Printer Drivers
Disk|tmp|oh noes!
Disk|opt|
IPC|IPC$|IPC Service (metasploitable server (Samba 3.0.20-Debian))
IPC|ADMIN$|IPC Service (metasploitable server (Samba 3.0.20-Debian))
Example 8 — One-shot non-interactive command execution
smbclient //192.168.56.101/tmp -N -c "ls"
. D 0 Wed Jul 15 05:23:11 2026
.. D 0 Wed Jul 15 05:23:11 2026
notes.txt N 42 Wed Jul 15 05:23:11 2026
Example 9 — Testing IPC$ share for null session validity
smbclient -L //192.168.56.101 -N -m SMB2
protocol negotiation failed: NT_STATUS_CONNECTION_RESET
(host does not support SMB2; retry without -m)
Example 10 — Uploading a file to a writable share
smb: \> put shell.php
putting file shell.php as \shell.php (12.4 kb/s) (average 12.4 kb/s)
Example 11 — Pass-the-hash authentication
smbclient //192.168.56.101/C$ -U administrator --pw-nt-hash 31d6cfe0d16ae931b73c59d7e0c089c0
Try "help" to get a list of possible commands.
smb: \>
Example 12 — Connecting on a non-default port
smbclient -L //192.168.56.101 -N -p 4455
Anonymous login successful
[share listing as usual]Common Use Cases
- Verifying whether anonymous/null SMB access is permitted (a common finding in vulnerability reports)
- Manually browsing and exfiltrating files from misconfigured, world-readable shares
- Confirming credentials obtained via password spraying/cracking by attempting an authenticated connection
- Uploading webshells or payloads to writable shares as part of exploitation
- Cross-validating share names reported by
enum4linux/smbmap/crackmapexec
Automation with Bash
#!/bin/bash
# smbclient_share_dump.sh - list and recursively pull every accessible share on a host
TARGET="$1"
OUTDIR="./smb_dump_${TARGET}"
mkdir -p "$OUTDIR"
shares=$(smbclient -L "//$TARGET" -N -g 2>/dev/null | grep -i '^Disk' | cut -d'|' -f2)
for share in $shares; do
echo "[*] Pulling share: $share"
mkdir -p "$OUTDIR/$share"
smbclient "//$TARGET/$share" -N \
-c "prompt OFF; recurse ON; lcd $OUTDIR/$share; mget *" 2>/dev/null
done
echo "[+] Done. Files saved under $OUTDIR"
Tips and Best Practices
- Always test
-N(null session) first; a huge number of internal networks still allow anonymous share listing. - Use
-gfor grepable output whenever piping results into other scripts. - Disable interactive
promptand enablerecursebefore usingmget *to avoid being asked to confirm every file. - When a host refuses SMB1 negotiation (common on hardened Windows Server 2019+), omit
-m SMB1/force-m SMB3. - Combine with
--pw-nt-hashto validate cracked/dumped NTLM hashes without needing the plaintext password.
Troubleshooting
| Problem | Likely Cause | Solution |
|---|---|---|
NT_STATUS_LOGON_FAILURE | Invalid credentials | Re-check username/password/domain, try -W for workgroup |
NT_STATUS_ACCESS_DENIED on connect | Anonymous access disabled for that share | Supply valid credentials with -U |
protocol negotiation failed: NT_STATUS_CONNECTION_RESET | SMB1 disabled on target (default since Win10 1709+/Server 2019+) | Force protocol: smbclient -L //ip -N -m SMB3 |
| Connection hangs indefinitely | Port 445 filtered/blocked by firewall | Confirm with nmap -p445 <ip>; try NetBIOS port 139 instead |
Unable to connect with SMB1 -- no workgroup available | NetBIOS name resolution failure | Add -I <ip> to bypass name resolution |
References
- Samba manual page: https://www.samba.org/samba/docs/current/man-html/smbclient.1.html
- Kali Linux tool page: https://www.kali.org/tools/samba/
- Samba project homepage: https://www.samba.org/