smbmap: Enumerates and interacts with SMB shares

smbmap is a Python-based SMB share enumeration tool written by Shawn Evans (ShawnDEvans). It was designed to solve a specific pain point of smbclient: quickly determining not just which shares exist on a host, but the actual read/write permission level the current credentials (or a null session) have on each one, across an entire host or even a whole subnet, in a single command. Where smbclient -L only lists share names, smbmap actively attempts to list contents of every share and reports READ ONLY, READ, WRITE, or NO ACCESS for each.

smbmap also bundles convenience features useful during enumeration and exploitation:

• Recursive directory listing of accessible shares
• File upload/download directly from the command line (no interactive shell needed)
• Remote command execution via PsExec-style service creation (-x) if credentials have admin rights
• Searching for files by name/pattern across all shares
• Reading file contents directly to stdout with --dir-only / pattern-matching helpers

Installation

# Kali Linux (preinstalled)
sudo apt update
sudo apt install smbmap -y

# Verify
smbmap -h

# Manual install via pip (any Linux distro)
git clone https://github.com/ShawnDEvans/smbmap.git
cd smbmap
pip3 install -r requirements.txt --break-system-packages
python3 smbmap.py -h

Syntax

smbmap [options] -H <target>

Command-Line Options

Basic Usage

smbmap -H 192.168.56.101

Expected output:

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	print$                                            	NO ACCESS	Printer Drivers
	tmp                                               	READ, WRITE	oh noes!
	opt                                               	NO ACCESS	
	IPC$                                              	NO ACCESS	IPC Service (metasploitable server (Samba 3.0.20-Debian))
	ADMIN$                                            	NO ACCESS	IPC Service (metasploitable server (Samba 3.0.20-Debian))

Practical Examples

Example 1 — Null session share/permission mapping

smbmap -H 192.168.56.101

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	tmp                                               	READ, WRITE	oh noes!

Example 2 — Authenticated permission mapping

smbmap -H 192.168.56.101 -u msfadmin -p msfadmin

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	tmp                                               	READ, WRITE	oh noes!
	opt                                               	READ ONLY	

Example 3 — Recursive listing of a writable share

smbmap -H 192.168.56.101 -r tmp

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	tmp                                               	READ, WRITE	oh noes!
	.\tmp\*
	dr--r--r--                    0 Wed Jul 15 05:23:11 2026	.
	dr--r--r--                    0 Wed Jul 15 05:23:11 2026	..
	fr--r--r--                   42 Wed Jul 15 05:23:11 2026	notes.txt

Example 4 — Deep recursive listing with depth limit

smbmap -H 192.168.56.101 -R tmp --depth 3

	.\tmp\*
	dr--r--r--                    0 Wed Jul 15 05:23:11 2026	subdir
	.\tmp\subdir\*
	fr--r--r--                10240 Wed Jul 15 05:23:11 2026	backup.zip

Example 5 — Downloading a discovered file

smbmap -H 192.168.56.101 --download "tmp\notes.txt"

[+] Starting download: tmp\notes.txt (42 bytes)
[+] File output to: /home/kali/192.168.56.101-tmp_notes.txt

Example 6 — Uploading a file to a writable share

smbmap -H 192.168.56.101 --upload /home/kali/shell.php "tmp\shell.php"

[+] Starting upload: /home/kali/shell.php (2048 bytes)
[+] Upload complete.

Example 7 — Searching for a filename pattern across all shares

smbmap -H 192.168.56.101 -u msfadmin -p msfadmin -A '\.txt$' -R

[+] Match found! tmp\notes.txt
[+] Match found! opt\readme.txt
[+] Retrieving matched files...

Example 8 — Remote command execution with admin credentials

smbmap -H 192.168.10.10 -u administrator -p 'P@ssw0rd!' -x "whoami"

[+] Command executed successfully!
nt authority\system

Example 9 — Scanning a whole subnet from a target list

smbmap -H targets.txt -u guest -p ''

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	tmp                                               	READ, WRITE
[+] IP: 192.168.56.105:445	Name: 192.168.56.105
	Users                                              	READ ONLY

Example 10 — Quiet mode: only show accessible shares

smbmap -H 192.168.56.101 -q

[+] IP: 192.168.56.101:445	Name: 192.168.56.101
	tmp                                               	READ, WRITE	oh noes!

Example 11 — Grep recursive listing for a keyword

smbmap -H 192.168.56.101 -R tmp -g password

[+] Grep results for 'password':
	.\tmp\config\db_password.txt

Example 12 — Pass-the-hash authentication

smbmap -H 192.168.10.10 -u administrator -p aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

[+] IP: 192.168.10.10:445	Name: dc01.corp.local
	C$                                                	READ, WRITE	Default share

Common Use Cases

• Rapid identification of writable SMB shares that can host webshells or malicious payloads
• Bulk permission auditing across an entire subnet with a single command and credential set
• Searching large file shares for sensitive filenames (password, .kdbx, .pem, backup) during post-exploitation
• Validating pass-the-hash credentials for lateral movement without a separate tool
• Lightweight remote command execution (-x) as an alternative to psexec.py when only SMB access is available

Automation with Bash

#!/bin/bash
# smbmap_sweep.sh - Check every host in targets.txt for writable shares, log positives
TARGETS="targets.txt"
CREDS_USER="guest"
CREDS_PASS=""
LOG="writable_shares.log"
> "$LOG"

while read -r ip; do
    echo "[*] Checking $ip"
    result=$(smbmap -H "$ip" -u "$CREDS_USER" -p "$CREDS_PASS" -q 2>/dev/null | grep "READ, WRITE")
    if [ -n "$result" ]; then
        echo "$ip -> $result" | tee -a "$LOG"
    fi
done < "$TARGETS"

echo "[+] Sweep complete. Writable shares logged in $LOG"

Tips and Best Practices

• Run smbmap with no credentials first (guest/blank) — many internal shares are misconfigured for anonymous write access.
• Use -q during large subnet sweeps to cut noise and only surface shares worth investigating manually.
• -R (deep recursive) can be very slow on large file servers; always pair it with --depth to bound execution time.
• The -x remote execution feature requires local administrator rights on the target — treat a successful run as a critical finding.
• Combine smbmap -A (search) with -R to hunt for credential files, configuration files, and backups in one pass.

Troubleshooting

References

• Official repository: https://github.com/ShawnDEvans/smbmap
• Kali Linux tool page: https://www.kali.org/tools/smbmap/
• Related tool comparison: CrackMapExec / NetExec — https://github.com/Pennyw0rth/NetExec