Offensive Security Researcher & Quantum Cryptography Analyst

smbmap: Assesses SMB shares for security issues

Abdul Wahab Junaid
smbmap: Assesses SMB shares for security issues

SMB shares are one of the most consistently productive places to look during an internal pentest — misconfigured permissions on file shares routinely expose credentials in scripts, backup files, configuration files with embedded passwords, and sometimes entire sensitive document repositories that should never have been broadly accessible. smbmap is the tool I use to quickly enumerate SMB shares across a target or an entire network, check the actual permission level I have on each one, and even browse, download, or upload files directly from the command line.

This article covers what smbmap does, how it interacts with SMB under the hood, installation, syntax, real command examples, and how I build it into a broader internal assessment workflow.

What SMBMap Does

smbmap is a Python-based SMB enumeration tool that:

Architecture and Internal Working

smbmap is built on top of the Impacket library, which implements the SMB protocol stack in pure Python. Its core workflow:

  1. It establishes an SMB session against the target using supplied credentials, a null session, or guest access.
  2. It queries the server for the list of available shares via the standard SMB share enumeration RPC calls.
  3. For each discovered share, it attempts to connect (tree connect) and tests actual read/write access by attempting real operations (like listing the root directory), rather than just trusting reported ACL metadata — this is important because reported permissions and actually enforced permissions don’t always match.
  4. When browsing (-R or a specific path), it walks the directory tree using standard SMB file listing operations, printing file names, sizes, and modification timestamps.
  5. For upload/download/search functions, it uses Impacket’s file I/O operations directly against the SMB session, avoiding the need for a separately mounted share.

Installation

Debian/Kali:

sudo apt update
sudo apt install smbmap -y

Via pip:

pip install smbmap

From source:

git clone https://github.com/ShawnDEvans/smbmap.git
cd smbmap
pip install -r requirements.txt
python3 smbmap.py --help

Verify:

smbmap --version

Basic Syntax

smbmap [options] -H <target>

Command Examples

1. Anonymous/null session share enumeration

smbmap -H 192.168.1.20

Sample output:

[+] IP: 192.168.1.20:445	Name: 192.168.1.20
        Disk                                                  Permissions	Comment
        ----                                                  -----------	-------
        ADMIN$                                                NO ACCESS	Remote Admin
        C$                                                    NO ACCESS	Default share
        IPC$                                                  READ ONLY	Remote IPC
        Backups                                               READ, WRITE	
        Users                                                 READ ONLY

2. Authenticated enumeration with credentials

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!'

3. Using a domain account

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' -d CORP

4. Using a hash instead of a plaintext password (pass-the-hash)

smbmap -H 192.168.1.20 -u jdoe -p aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

5. Recursively listing contents of an accessible share

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' -r Backups

6. Recursively listing everything readable across all shares

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' -R

7. Downloading a specific file

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' --download 'Backups\config.bak'

8. Uploading a file (only where write access exists — used in authorized testing to validate impact)

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' --upload /tmp/testfile.txt 'Backups\testfile.txt'

9. Searching across shares for specific filenames

smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' -A 'password' -R

The -A flag greps file contents for a pattern (subject to file type and size handling) across recursively listed shares — very effective for surfacing files with “password” in the name or content during a search.

10. Scanning an entire subnet from a host list

smbmap -H targets.txt -u jdoe -p 'Password123!'

Configuration Options

FlagPurpose
-HTarget host or file of hosts
-u / -pUsername and password
-dDomain
-r / -RList or recursively list share contents
--downloadDownload a specific file
--uploadUpload a specific file
-A <pattern>Search/grep across files matching a pattern
-P <port>Set SMB port (default 445)
--no-bannerSuppress the ASCII banner for cleaner scripted output

Real-World Use Cases

Internal pentest credential/data hunting: After obtaining a foothold or a low-privilege domain account, running smbmap against discovered hosts is one of the fastest ways to find writable shares, exposed backups, and files containing credentials.

Privilege escalation path discovery: Finding a share where a low-privilege account has write access, but where a scheduled task or service on the target reads from that share, is a classic and well-documented privilege escalation vector worth confirming in a report.

Null session/anonymous access audits: Confirming whether legacy SMB configurations still allow null-session share enumeration — a longstanding, still-common finding on internal networks running older Windows Server configurations or misconfigured Samba shares.

Data exposure assessment: Using the search/grep functionality to identify shares broadly containing sensitive file types (backup files, configuration files, spreadsheets with “password” in the name) helps quantify real-world data exposure risk for a client report.

Incident response — access review: During IR engagements, confirming exactly what shares a compromised account could access (and what was actually readable/writable) helps scope the potential blast radius of a compromise.

Workflow and Tool Integration

# Step 1: discover SMB hosts
nmap -p 445 --open 192.168.1.0/24 -oG smb_hosts.txt

# Step 2: extract live hosts
grep "445/open" smb_hosts.txt | awk '{print $2}' > smb_targets.txt

# Step 3: enumerate shares across all discovered hosts
smbmap -H smb_targets.txt -u jdoe -p 'Password123!' --no-banner > smbmap_results.txt

# Step 4: recursively list and search any writable/readable shares of interest
smbmap -H 192.168.1.20 -u jdoe -p 'Password123!' -R -A 'password|secret|backup'

I usually run smbmap right after crackmapexec/netexec confirms valid credentials across a range, since that combination gives both a fast credential validity sweep and a detailed per-share permission breakdown.

Performance Optimization

Troubleshooting

Best Practices and Common Mistakes

FAQ

Does smbmap work against Samba servers as well as Windows? Yes — since it operates at the SMB protocol level via Impacket, it works against both Windows SMB implementations and Samba on Linux/Unix systems.

Can smbmap execute commands on a remote host? Older versions supported remote command execution via specific share-based techniques; modern workflows typically favor dedicated tools like impacket-psexec or crackmapexec/netexec for that specific purpose, using smbmap primarily for share enumeration and file operations.

Is a null session finding still relevant today? Yes — while less common than in the past, null-session-accessible shares still turn up on internal assessments and represent a straightforward, high-confidence finding when discovered.

Lab Example

In a lab, set up a Windows Server VM with a file share configured for “Everyone: Read/Write” (a deliberately weak configuration for the exercise), then run:

smbmap -H 192.168.56.80 -u guest -p ''
smbmap -H 192.168.56.80 -u guest -p '' -R

Confirm the misconfigured share is discovered and browsable, then correct the share permissions to a proper least-privilege configuration and re-run to confirm access is now denied.

Summary

smbmap consistently turns up some of the most impactful findings in internal assessments — writable shares, exposed credentials in backup files, and privilege escalation paths hiding in plain sight on file servers. Its combination of fast enumeration, recursive listing, content searching, and direct file transfer makes it one of the most efficient single tools for SMB-focused testing.

References

Exit mobile version