security enabled verified high v1.0.0

smbmap

SMB enumeration tool that provides recursive listing, file download/upload, and command execution across SMB shares on Windows networks.

📋 Live Preview 
smbmap -H {target} -u {username} -p {password}
🌍 target → ip 🌍 username → user 📎 password 
smbmap -H {target} -u {username} -p {password}

Sandbox: execFile · Timeout: 120s

Capabilities

security.ad.share.list
security.ad.share.download
security.ad.share.upload
security.ad.share.delete
security.ad.share.exec
security.ad.share.content

Parameters

Name Type Required Default Description Aliases
host string Yes - Target IP address or hostname -H, --host
username string No - Username for SMB authentication -u, --username
password string No - Password or NTLM hash for authentication -p, --password
domain string No - Domain name for authentication -d, --domain
port integer No 445 SMB port number -P, --port
share string No - Specify a share to enumerate -s, --share
recursive boolean No Recursive directory listing -r, --recursive
depth integer No 10 Recursion depth for directory listing -R, --depth
command string No - Command to execute via SMB -x, --command
content boolean No Show file contents -C, --content
download string No - Download file by path --download
upload string No - Upload file (local:remote) --upload
timeout integer No 10 Network timeout in seconds --timeout
S boolean No - Force SMB over SSL -S, --ssl
no_banner boolean No - Suppress banner --no-banner
no_color boolean No - Disable color output --no-color
q boolean No - Quiet mode -q, --quiet
s boolean No - Specify a share -s, --share

Contract

Inputs

network.target.ip

Target IP or hostname

credential.username

Username for SMB authentication

credential.password

Password or NTLM hash

Outputs

security.ad.share.list

Recursive share listing with permissions

file.content

Downloaded file contents

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

security.ad.share.listfile.content

Consumes

network.target.ipcredential.usernamecredential.password

Resource Profile

ResourceValue
CPUlow
Memory32 MB
Networklow
Disk I/Olow

Examples

Enumerate all shares with null session

smbmap -H 10.10.10.1 -u null -p null

Authenticated recursive share listing

smbmap -H 10.10.10.1 -u jdoe -p Pass123 -r

Download a specific file from a share

smbmap -H 10.10.10.1 -u jdoe -p Pass123 --download C$/Users/Administrator/Desktop/notes.txt

Upload a file to a share

smbmap -H 10.10.10.1 -u jdoe -p Pass123 --upload /tmp/shell.exe C$/temp/shell.exe

Execute a command via SMB

smbmap -H 10.10.10.1 -u jdoe -p Pass123 -x "ipconfig"

Show contents of text files in a share

smbmap -H 10.10.10.1 -u jdoe -p Pass123 -s Shared -C

Documentation

smbmap — SMB Share Enumeration

smbmap is a Python-based SMB enumeration tool that recursively lists share contents, checks permissions, downloads/uploads files, and executes commands—all without needing a full interactive SMB session.

Key Features

  • Recursive listing: Map out entire directory trees across shares
  • Permission-aware: Shows READ/WRITE/DENIED per share and path
  • File operations: Download, upload, and delete files
  • Command execution: Run shell commands via SMB (admin required)
  • NTLM hash auth: Authenticate with LM:NT hash instead of password

Usage Modes

Mode Command Description
Basic enum smbmap -H target -u user -p pass List all accessible shares
Recursive smbmap -H target -u user -p pass -r Deep directory listing
Download smbmap -H target -u user -p pass --download PATH Grab a specific file
Upload smbmap -H target -u user -p pass --upload L R Push a file to target
Exec smbmap -H target -u user -p pass -x cmd Remote command execution

Dependencies

python3

Related Tools

smbclientenum4linux-ngimpacket

References