Enumerate SMB/RPC shares, files and identities

List shares without credentials

Copy# Baseline: list shares without credentials
smbclient -N -L //TARGET

# Variant — authenticated share listing and connection
smbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
smbclient -L //TARGET -U 'TARGET/USER'
smbclient -L //TARGET -U 'guest%'

Decisive output: a share list proves that this access context can enumerate names. It does not prove access to share contents. NT_STATUS_ACCESS_DENIED means this context was denied; repeat after obtaining a legitimate credential.

Inside the share

The first two forms use a domain identity, the third makes a local target account explicit, and the fourth tests a guest account with an empty password. Let the client prompt for non-empty passwords. Inside the share:

Copy# Inside the share
pwd
ls
allinfo FILE
get FILE
mkdir probe-dir
rmdir probe-dir
exit

Use a harmless uniquely named directory only when write permission must be verified. A successful create/remove establishes share-level write access, not code execution.

Recursive retrieval

Copy# Variant — recursive retrieval
smbclient //TARGET/SHARE -U 'DOMAIN/USER' -c 'recurse ON;prompt OFF;mget *'

# Variant — RPC null or authenticated session
rpcclient -U '' -N TARGET
rpcclient -U 'DOMAIN/USER' TARGET

Useful interactive queries

Copy# Useful interactive queries
srvinfo
enumdomains
enumdomusers
enumdomgroups
queryuser RID
netshareenumall
quit

Null-session denial is common on modern systems. Authenticated output must be labelled with the identity that produced it.

Fast permission summary and consolidated candidates

Copy# Variant — fast permission summary and consolidated candidates
nxc smb TARGET -u USER -p PASSWORD --shares
enum4linux-ng -A TARGET

# Variant — protocol, signing and time clues
nmap -p 139,445 --script smb-protocols,smb2-security-mode,smb2-time TARGET

Windows built-ins

Copy# Variant — Windows built-ins
net view \\TARGET /all
Get-ChildItem \\TARGET\SHARE
Get-Content \\TARGET\SHARE\FILE

These use the current Windows logon context unless alternate credentials or mappings are established. An existing connection to the same server under another identity can cause credential-conflict errors.

SMBMap — map rights, then read one useful file

Use from Kali when SMB is reachable. Choose the same domain/local identity that worked with smbclient. Suppress write probes when inventorying reads; this means a writable label is not being tested here.

Copy# SMBMap — map rights, then read one useful file
# Known domain account: enumerate share access without creating a probe file
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --no-write-check

# Inspect the selected share to a bounded depth
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' -r 'SHARE' --depth 2 --no-write-check

# Download the specific file found above
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --download 'SHARE\PATH\FILE' --no-write-check

Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.

SMBMap — map rights, then read one useful file

Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.

Copy# SMBMap — map rights, then read one useful file
# No credentials: anonymous RPC/SMB candidates
enum4linux-ng -A TARGET

# Known identity: domain objects visible to this account
enum4linux-ng -A -w DOMAIN -u USER -p 'PASSWORD' TARGET

Next: validate returned users/groups/shares with rpcclient or smbclient. A collector can return partial data despite a successful login.

Failure cues: distinguish connection failure, authentication failure, share enumeration denial and file authorization denial. A share named IPC$ is not a general file share. Guest acceptance may look like success while returning a restricted namespace. A share marked writable still needs a consumer/trigger before it becomes an execution path.

Next action: inspect readable content, record per-share rights, validate names/domain clues, and re-run authenticated enumeration whenever identity changes. Move file-consumer hypotheses to web/execution/escalation and signing/relay hypotheses to the later credential/AD blocks.

NetBIOS names before SMB enumeration

Use when UDP/137 or SMB suggests Windows names but DNS/domain identity is unclear.

Copy# NetBIOS names before SMB enumeration
# Ask the assigned host for its NetBIOS names
nbtscan TARGET
nmblookup -A TARGET

Read: a machine name and group/domain label are leads. A workgroup label does not prove AD membership. Resolve the returned name and use the SMB/LDAP checks with the accepted identity. No reply can mean filtering or disabled NetBIOS while TCP/445 still works.

SMB/RPC RID lookups when a normal user listing is denied

Use when the accepted identity can translate SIDs but cannot list the directory directly. Keep the queried host/domain and a bounded RID range explicit.

Copy# SMB/RPC RID lookups when a normal user listing is denied
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --rid-brute 4000