smbmap is a Python-based SMB share enumeration tool written by Shawn Evans (ShawnDEvans). It was designed to solve a specific pain point of smbclient: quickly determining not just which shares exist on a host, but the actual read/write permission level the current credentials (or a null session) have on each one, across an entire host or even a whole subnet, in a single command. Where smbclient -L only lists share names, smbmap actively attempts to list contents of every share and reports READ ONLY, READ, WRITE, or NO ACCESS for each.
smbmap also bundles convenience features useful during enumeration and exploitation:
- Recursive directory listing of accessible shares
- File upload/download directly from the command line (no interactive shell needed)
- Remote command execution via PsExec-style service creation (
-x) if credentials have admin rights - Searching for files by name/pattern across all shares
- Reading file contents directly to stdout with
--dir-only/ pattern-matching helpers
Installation
# Kali Linux (preinstalled)
sudo apt update
sudo apt install smbmap -y
# Verify
smbmap -h
# Manual install via pip (any Linux distro)
git clone https://github.com/ShawnDEvans/smbmap.git
cd smbmap
pip3 install -r requirements.txt --break-system-packages
python3 smbmap.py -h
Syntax
smbmap [options] -H <target>
Command-Line Options
| Option | Description |
|---|---|
-H, --host | Target host IP/hostname (also accepts a file with - prefix for CIDR/list) |
-P, --port | SMB port (default 445) |
-u, --username | Username for authentication |
-p, --password | Password (or NTLM hash in LM:NT format) for authentication |
-d, --domain | Domain to authenticate against (default WORKGROUP) |
-r, --recursive | Recursively list dirs and files in root directories |
-R, --deep-recursive | Recursively list dirs and files starting at top-level share dir |
--depth | Maximum recursion depth (used with -R) |
-A, --search | Search for filenames matching a regex pattern across all shares, retrieve matching files |
-x, --exec | Execute a remote command via a Windows service (requires admin creds) |
-X, --execute-hidden | Same as -x, but hides service window |
--upload | Upload a local file to a remote share/path |
--download | Download a remote file to local disk |
--delete | Delete a remote file (be careful — this is destructive) |
-s, --share | Specify a share to connect to directly (skip auto-listing) |
--nao, --no-banner | Suppress banner |
-v, --verbose | Verbose output |
-q, --quiet | Only display shares with READ or WRITE access |
-t, --timeout | Set connection timeout |
-g, --grep | Grep results for a string during recursive listing |
Basic Usage
smbmap -H 192.168.56.101
Expected output:
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
tmp READ, WRITE oh noes!
opt NO ACCESS
IPC$ NO ACCESS IPC Service (metasploitable server (Samba 3.0.20-Debian))
ADMIN$ NO ACCESS IPC Service (metasploitable server (Samba 3.0.20-Debian))
Practical Examples
Example 1 — Null session share/permission mapping
smbmap -H 192.168.56.101
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
tmp READ, WRITE oh noes!
Example 2 — Authenticated permission mapping
smbmap -H 192.168.56.101 -u msfadmin -p msfadmin
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
tmp READ, WRITE oh noes!
opt READ ONLY
Example 3 — Recursive listing of a writable share
smbmap -H 192.168.56.101 -r tmp
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
tmp READ, WRITE oh noes!
.\tmp\*
dr--r--r-- 0 Wed Jul 15 05:23:11 2026 .
dr--r--r-- 0 Wed Jul 15 05:23:11 2026 ..
fr--r--r-- 42 Wed Jul 15 05:23:11 2026 notes.txt
Example 4 — Deep recursive listing with depth limit
smbmap -H 192.168.56.101 -R tmp --depth 3
.\tmp\*
dr--r--r-- 0 Wed Jul 15 05:23:11 2026 subdir
.\tmp\subdir\*
fr--r--r-- 10240 Wed Jul 15 05:23:11 2026 backup.zip
Example 5 — Downloading a discovered file
smbmap -H 192.168.56.101 --download "tmp\notes.txt"
[+] Starting download: tmp\notes.txt (42 bytes)
[+] File output to: /home/kali/192.168.56.101-tmp_notes.txt
Example 6 — Uploading a file to a writable share
smbmap -H 192.168.56.101 --upload /home/kali/shell.php "tmp\shell.php"
[+] Starting upload: /home/kali/shell.php (2048 bytes)
[+] Upload complete.
Example 7 — Searching for a filename pattern across all shares
smbmap -H 192.168.56.101 -u msfadmin -p msfadmin -A '\.txt$' -R
[+] Match found! tmp\notes.txt
[+] Match found! opt\readme.txt
[+] Retrieving matched files...
Example 8 — Remote command execution with admin credentials
smbmap -H 192.168.10.10 -u administrator -p 'P@ssw0rd!' -x "whoami"
[+] Command executed successfully!
nt authority\system
Example 9 — Scanning a whole subnet from a target list
smbmap -H targets.txt -u guest -p ''
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
tmp READ, WRITE
[+] IP: 192.168.56.105:445 Name: 192.168.56.105
Users READ ONLY
Example 10 — Quiet mode: only show accessible shares
smbmap -H 192.168.56.101 -q
[+] IP: 192.168.56.101:445 Name: 192.168.56.101
tmp READ, WRITE oh noes!
Example 11 — Grep recursive listing for a keyword
smbmap -H 192.168.56.101 -R tmp -g password
[+] Grep results for 'password':
.\tmp\config\db_password.txt
Example 12 — Pass-the-hash authentication
smbmap -H 192.168.10.10 -u administrator -p aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[+] IP: 192.168.10.10:445 Name: dc01.corp.local
C$ READ, WRITE Default share
Common Use Cases
- Rapid identification of writable SMB shares that can host webshells or malicious payloads
- Bulk permission auditing across an entire subnet with a single command and credential set
- Searching large file shares for sensitive filenames (
password,.kdbx,.pem,backup) during post-exploitation - Validating pass-the-hash credentials for lateral movement without a separate tool
- Lightweight remote command execution (
-x) as an alternative topsexec.pywhen only SMB access is available
Automation with Bash
#!/bin/bash
# smbmap_sweep.sh - Check every host in targets.txt for writable shares, log positives
TARGETS="targets.txt"
CREDS_USER="guest"
CREDS_PASS=""
LOG="writable_shares.log"
> "$LOG"
while read -r ip; do
echo "[*] Checking $ip"
result=$(smbmap -H "$ip" -u "$CREDS_USER" -p "$CREDS_PASS" -q 2>/dev/null | grep "READ, WRITE")
if [ -n "$result" ]; then
echo "$ip -> $result" | tee -a "$LOG"
fi
done < "$TARGETS"
echo "[+] Sweep complete. Writable shares logged in $LOG"
Tips and Best Practices
- Run
smbmapwith no credentials first (guest/blank) — many internal shares are misconfigured for anonymous write access. - Use
-qduring large subnet sweeps to cut noise and only surface shares worth investigating manually. -R(deep recursive) can be very slow on large file servers; always pair it with--depthto bound execution time.- The
-xremote execution feature requires local administrator rights on the target — treat a successful run as a critical finding. - Combine
smbmap -A(search) with-Rto hunt for credential files, configuration files, and backups in one pass.
Troubleshooting
| Problem | Likely Cause | Solution |
|---|---|---|
[!] Authentication error on 192.168.56.101 | Wrong credentials or account locked | Verify creds; check account lockout policy before retrying |
All shares show NO ACCESS | Guest/null access disabled | Try -u guest -p "", or supply a valid domain account |
--download fails with permission denied locally | No write permission in local output directory | Run from a writable directory or specify absolute local path |
| Extremely slow recursive scan | Very large/deep share tree | Limit with --depth, or target a specific subdirectory with -s |
-x execution fails silently | Account lacks admin rights, or ADMIN$ not shared | Confirm admin group membership; test with crackmapexec for comparison |
References
- Official repository: https://github.com/ShawnDEvans/smbmap
- Kali Linux tool page: https://www.kali.org/tools/smbmap/
- Related tool comparison: CrackMapExec / NetExec — https://github.com/Pennyw0rth/NetExec
