Skip to content
HackIndex logo

HackIndex

SMB Share Enumeration

6 min read Jul 14, 2026

SMB share enumeration identifies every share exposed on a target, maps read and write permissions for the current credential set, and explores file contents inside accessible shares. Exposed shares frequently contain configuration files, scripts, backups, and credential material.

List Shares and Permissions with nxc

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --shares 
SMB   10.10.10.5  445  DC01  Share           Permissions    Remark
SMB   10.10.10.5  445  DC01  ADMIN$                         Remote Admin
SMB   10.10.10.5  445  DC01  Backups         READ,WRITE
SMB   10.10.10.5  445  DC01  C$                             Default share
SMB   10.10.10.5  445  DC01  IPC$            READ           Remote IPC
SMB   10.10.10.5  445  DC01  NETLOGON        READ           Logon server share
SMB   10.10.10.5  445  DC01  SYSVOL          READ           Logon server share
Explain command
$TARGET_IP Target host IP address to connect to via SMB.
-u $USER Username to authenticate with.
-p $PASSWORD Password to authenticate with.
--shares Enumerate available SMB shares on the target.

READ,WRITE on a non-default share is worth exploring immediately. ADMIN$ and C$ with access means admin-level credentials — pivot to Pass-the-Hash over SMB or AD Remote Execution. SYSVOL and NETLOGON are readable by any domain user — check them for Group Policy files and logon scripts.

Anonymous share listing:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u '' -p '' --shares
Explain command
$TARGET_IP Target host IP address to connect to via SMB.
-u '' Authenticate with an empty/null username (anonymous auth).
-p '' Authenticate with an empty/null password (anonymous auth).
--shares Enumerate accessible SMB shares on the target.

Spider Share Contents with nxc

After identifying readable shares, search their contents without manual browsing:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --spider $SHARE --pattern '\.txt$|\.xml$|\.ini$|\.conf$|\.config$|\.ps1$|\.bat$'
Explain command
$TARGET_IP Target host IP address to connect to via SMB.
-u $USER Username for SMB authentication.
-p $PASSWORD Password for SMB authentication.
--spider $SHARE Recursively spider the specified SMB share for files.
--pattern '\..txt$|\..xml$|\..ini$|\..conf$|\..config$|\..ps1$|\..bat$' Regex pattern to filter files by extension during spidering.

Search file content for credential patterns:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --spider $SHARE --content --pattern 'password|passwd|secret|token'
Explain command
$TARGET_IP Target host IP address to connect to via SMB.
-u $USER Username to authenticate with.
-p $PASSWORD Password to authenticate with.
--spider $SHARE Recursively spider the specified SMB share.
--content Download and search file contents during spidering.
--pattern 'password|passwd|secret|token' Regex pattern to match sensitive strings in file contents.

smbclient for Interactive Browsing

List shares:

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -U $USER%$PASSWORD
Explain command
-L List available shares on the specified SMB server.
//$TARGET_IP Target SMB server IP address in UNC path format.
-U $USER%$PASSWORD Authenticate with specified username and password (user%pass format).

Connect to a share:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD
Explain command
//$TARGET_IP/$SHARE UNC-style path specifying target IP and SMB share name to connect to
-U $USER%$PASSWORD Specifies the username and password separated by % for authentication

Useful commands inside the session:

ls                    list current directory
cd PATH               change directory
get filename          download a single file
recurse ON            enable recursive listing
prompt OFF            disable download prompts
mget *                download everything recursively

Recursive listing in one command:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD -c 'recurse ON; ls'
Explain command
//$TARGET_IP/$SHARE UNC-style path specifying target IP and SMB share name to connect to.
-U $USER%$PASSWORD Authenticates with the specified username and password (user%pass format).
-c 'recurse ON; ls' Executes SMB commands: enables recursive listing then lists all files.

Recursive download of an entire share:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD -c 'prompt OFF; recurse ON; mget *'
Explain command
//$TARGET_IP/$SHARE UNC-style path specifying target SMB server IP and share name.
-U $USER%$PASSWORD Authenticate with specified username and password separated by %.
-c 'prompt OFF; recurse ON; mget *' Run commands: disable prompts, enable recursion, download all files.

smbmap for Permission Mapping

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u $USER -p $PASSWORD
Explain command
-H $TARGET_IP Specifies the target host IP address to connect to.
-u $USER Specifies the username for SMB authentication.
-p $PASSWORD Specifies the password for SMB authentication.

Recursive listing of a specific share:

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u $USER -p $PASSWORD -r $SHARE
Explain command
-H $TARGET_IP Specifies the target host IP address to connect to.
-u $USER Specifies the username for SMB authentication.
-p $PASSWORD Specifies the password for SMB authentication.
-r $SHARE Recursively lists the contents of the specified share.

Download a specific file:

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u $USER -p $PASSWORD --download '$SHARE\path\to\file.txt'
Explain command
-H $TARGET_IP Specifies the target host IP address to connect to.
-u $USER Specifies the username for SMB authentication.
-p $PASSWORD Specifies the password for SMB authentication.
--download '$SHARE\path\to\file.txt' Downloads the specified file from the given SMB share path.

impacket-smbclient

Works well when smbclient has issues with SMB signing requirements or dialect negotiation. Also handles pass-the-hash directly:

┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP
Explain command
$DOMAIN/$USER:$PASSWORD@$TARGET_IP Target credentials and host in domain/user:password@host format.

Pass-the-hash:

┌──(kali㉿kali)-[~]
└─$ impacket-smbclient -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP
Explain command
-hashes :$NTHASH Authenticate using LM:NT hash pair; LM left empty, NT hash provided.
$DOMAIN/$USER@$TARGET_IP Target specifying domain, username, and IP address for SMB connection.

The same ls, cd, get, and mget commands apply inside the session.

Mounting Shares

Mounting gives access to local tools like grep and find against share contents:

┌──(kali㉿kali)-[~]
└─$ sudo mkdir -p /mnt/smb
┌──(kali㉿kali)-[~]
└─$ sudo mount -t cifs //$TARGET_IP/$SHARE /mnt/smb -o username=$USER,password=$PASSWORD,domain=$DOMAIN
Explain command
-p Create parent directories as needed, no error if existing.
-t cifs Specifies the filesystem type as CIFS (SMB protocol).
//$TARGET_IP/$SHARE UNC-style path to the remote SMB share host and name.
/mnt/smb Local mount point directory for the remote share.
-o username=$USER SMB authentication username for the remote share.
-o password=$PASSWORD SMB authentication password for the remote share.
-o domain=$DOMAIN Windows domain or workgroup for SMB authentication.

Anonymous mount:

┌──(kali㉿kali)-[~]
└─$ sudo mount -t cifs //$TARGET_IP/$SHARE /mnt/smb -o guest
Explain command
-t cifs Specifies the filesystem type as CIFS (SMB protocol).
//$TARGET_IP/$SHARE UNC-style path to the remote SMB share on the target host.
/mnt/smb Local mount point directory where the share will be attached.
-o guest Mounts the share without authentication using guest access.

After mounting, search for credential material:

┌──(kali㉿kali)-[~]
└─$ grep -r -i 'password\|passwd\|secret\|connectionstring' /mnt/smb/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /mnt/smb -name "*.xml" -o -name "*.config" -o -name "*.ini" -o -name "*.ps1" 2>/dev/null
Explain command
-r Recursively search through all subdirectories.
-i Perform case-insensitive pattern matching.
'password\|passwd\|secret\|connectionstring' Regex pattern matching common credential-related keywords.
/mnt/smb/ Target directory; mounted SMB share to search within.
2>/dev/null Suppress stderr output by redirecting errors to null.
/mnt/smb Root directory to search; mounted SMB share.
-name "*.xml" Match files with .xml extension.
-name "*.config" Match files with .config extension.
-name "*.ini" Match files with .ini extension.
-name "*.ps1" Match PowerShell script files with .ps1 extension.
-o Logical OR operator to combine multiple -name expressions.

Unmount when done:

┌──(kali㉿kali)-[~]
└─$ sudo umount /mnt/smb

High-Value Shares

SYSVOL and NETLOGON on domain controllers contain Group Policy files and logon scripts. Check for Groups.xml, Services.xml, Scheduledtasks.xml, and Datasources.xml — these may contain cpassword values encrypted with a publicly documented Microsoft key:

┌──(kali㉿kali)-[~]
└─$ find /mnt/smb -name "*.xml" 2>/dev/null | xargs grep -l "cpassword" 2>/dev/null
Explain command
/mnt/smb Starting directory for the search, typically a mounted SMB share.
-name "*.xml" Match files with .xml extension.
2>/dev/null Suppress stderr by redirecting errors to null device.
-l Print only filenames of files containing the match, not the lines.
"cpassword" Search term targeting GPP encrypted passwords in Group Policy XML files.

Backup shares frequently contain database dumps, configuration archives, and directory backups.

IT and scripts shares commonly hold PowerShell and batch scripts with hardcoded credentials.

References