SMBMAP(1)

💖 NAME 💖

smbmap — the SMB enumeration tool, bestie. Like, the whole point of it. 🦋

---

🦋 SYNOPSIS 🦋

smbmap [-h] (-H HOST | --host-file FILE) [-u USERNAME] [-p PASSWORD
|--prompt] [-s SHARE] [-d DOMAIN] [-P PORT] [-v] [--admin] [--no-banner]
[--no-color] [--no-update] [-x COMMAND][--mode CMDMODE] [-L | -r [PATH]]
[-A PATTERN | -g FILE | --csv FILE] [--dir-only][--no-write-check] [-q]
[--depth DEPTH] [--exclude SHARE [SHARE ...]] [-F PATTERN] [--search-
path PATH] [--search-timeout TIMEOUT] [--download PATH] [--upload SRC
DST] [--delete PATH TO FILE] [--skip]

---

🌸 DESCRIPTION 🌸

okay so picture this: SMBMap lets you enumerate samba share drives across an entire domain. An entire domain!! 💅

It can list share drives, list drive permissions, list share contents, do the whole upload/download thing, do file name auto-download pattern matching, and it can literally execute remote commands. The way that this tool was designed with pen testing in mind… it's giving "let me simplify searching for potentially sensitive data across large networks." Periodt. 👑

---

✨ OPTIONS ✨

👑 Main arguments:

• -H HOST — IP of host 🫶
• --host-file FILE — a file containing a list of hosts
• -u USERNAME, --username USERNAME — the username. If you omit it, a null session is assumed, bestie
• -p PASSWORD, --password PASSWORD — password, or an NTLM hash 🔥
• --prompt — prompts you for a password
• -s SHARE — specify a share (default C$), ex 'C$'
• -d DOMAIN — domain name (default WORKGROUP)
• -P PORT — SMB port (default 445)
• -v, --version — return the OS version of the remote host ⭐
• --signing — check if host has SMB signing disabled, enabled, or required
• --admin — just report if the user is an admin, nothing more, no crumbs
• --no-banner — removes the banner from the top of the output
• --no-color — removes the color from output 🎀
• --no-update — removes the "Working on it" message
• --timeout SCAN_TIMEOUT — set port scan socket timeout. Default is .5 seconds

Kerberos settings:

• -k, --kerberos — use Kerberos authentication ✨
• --no-pass — use CCache file (export KRB5CCNAME='~/current.ccache')
• --dc-ip IP or Host — IP or FQDN of DC

Command Execution:

Options for executing commands on the specified host 😌

• -x COMMAND — execute a command ex. 'ipconfig /all'
• --mode CMDMODE — set the execution method, wmi or psexec, default wmi

Shard drive Search:

Options for searching/enumerating the filesystem of the specified host 🔍

• -L — list all drives on the specified host, requires ADMIN rights. no cap
• -r [PATH] — recursively list dirs and files (with no PATH it lists the root of ALL shares), ex. 'email/backup'
• -g FILE — output to a file in a grep friendly format, used with -r (otherwise it outputs nothing), ex -g grep_out.txt
• -A PATTERN — define a file name pattern (regex) that auto downloads a file on a match (requires -r), not case sensitive, ex '(web|global).(asax|config)'
• --csv FILE — output to a CSV file, ex --csv shares.csv
• --dir-only — list only directories, omit files
• --no-write-check — skip check to see if drive grants WRITE access
• -q — quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when performing a search (-A)
• --depth DEPTH — traverse a directory tree to a specific depth. Default is 1 (root node)
• --exclude SHARE [SHARE ...] — exclude share(s) from searching and listing, ex. --exclude ADMIN$ C$'

File Content Search:

Options for searching the content of files (must run as root), kind of experimental 🙈

• -F PATTERN — file content search, -F '[Pp]assword' (requires admin access to execute commands, and powershell on victim host)
• --search-path PATH — specify drive/path to search (used with -F, default C:\Users), ex 'D:\HR\'
• --search-timeout TIMEOUT — specify a timeout (in seconds) before the file search job gets killed. Default is 300 seconds

Filesystem interaction:

Options for interacting with the specified host's filesystem 🧚

• --download PATH — download a file from the remote system, ex. 'C$\temp\passwords.txt'
• --upload SRC DST — upload a file to the remote system ex. '/tmp/payload.exe C$\temp\payload.exe'
• --delete PATH_TO_FILE — delete a remote file, ex. 'C$\temp\msf.exe'
• --skip — skip delete file confirmation prompt

---

🌈 EXAMPLES: 🌈

$ python smbmap.py -u jsmith -p password1 -d workgroup -H 192.168.0.1
$ python smbmap.py -u jsmith -p 'aad3b435b51404eeaad3b435b51404ee:da76f2c4c96028b7a6111aef4a50a94d' -H 172.16.0.20
$ python smbmap.py -u 'apadmin' -p 'asdf1234!' -d ACME -H 10.1.3.30 -x 'net group "Domain Admins" /domain'

look at that NTLM hash in example two. iconic. 💜

---

💜 AUTHOR 💜

smbmap was developed by ShawnDEvans <ShawnDEvans@gmail.com> 🫶

This manual page was written by Samuel Henrique <samueloph@debian.org> for the Debian project, it was based on smbmap -h output and can be used by other projects as well. slay.

---

and that's the whole page bestie!! this is smbmap 1.10.7, dated January 2025, from the User Commands manual — mwah, go enumerate something responsibly 💖✨🎀