# SMB Share Enumeration

> Enumerate SMB shares using tools like smbclient, crackmapexec, and enum4linux to discover exposed network shares, permissions, and accessible files.

- **URL:** https://hackindex.io/services/smb/enumeration/smb-share-enumeration
- **Path:** SMB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/smb/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-07-14

SMB share enumeration identifies every share exposed on a target, maps read and write permissions for the current credential set, and explores file contents inside accessible shares. Exposed shares frequently contain configuration files, scripts, backups, and credential material.

## SMB Share Enumeration with nxc

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --shares
# SMB   10.10.10.5  445  DC01  Share           Permissions    Remark
# SMB   10.10.10.5  445  DC01  ADMIN$                         Remote Admin
# SMB   10.10.10.5  445  DC01  Backups         READ,WRITE
# SMB   10.10.10.5  445  DC01  C$                             Default share
# SMB   10.10.10.5  445  DC01  IPC$            READ           Remote IPC
# SMB   10.10.10.5  445  DC01  NETLOGON        READ           Logon server share
# SMB   10.10.10.5  445  DC01  SYSVOL          READ           Logon server share
```

`READ,WRITE` on a non-default share is worth exploring immediately. `ADMIN$` and `C$` with access means admin-level credentials: pivot to [Pass-the-Hash over SMB](https://hackindex.io/services/smb/exploitation/pass-the-hash) or [AD Remote Execution](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution). `SYSVOL` and `NETLOGON` are readable by any domain user: check them for Group Policy files and logon scripts.

Anonymous share listing:

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
```

## Spider Share Contents with nxc

After identifying readable shares, search their contents without manual browsing:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --spider $SHARE --pattern '\.txt$|\.xml$|\.ini$|\.conf$|\.config$|\.ps1$|\.bat$'
```

Search file content for credential patterns:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD --spider $SHARE --content --pattern 'password|passwd|secret|token'
```

## smbclient for Interactive Browsing

List shares:

```bash
smbclient -L //$TARGET_IP -U $USER%$PASSWORD
```

Connect to a share:

```bash
smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD
```

Useful commands inside the session:

```
ls                    list current directory
cd PATH               change directory
get filename          download a single file
recurse ON            enable recursive listing
prompt OFF            disable download prompts
mget *                download everything recursively
```

Recursive listing in one command:

```bash
smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD -c 'recurse ON; ls'
```

Recursive download of an entire share:

```bash
smbclient //$TARGET_IP/$SHARE -U $USER%$PASSWORD -c 'prompt OFF; recurse ON; mget *'
```

## smbmap for Permission Mapping

```bash
smbmap -H $TARGET_IP -u $USER -p $PASSWORD
```

Recursive listing of a specific share:

```bash
smbmap -H $TARGET_IP -u $USER -p $PASSWORD -r $SHARE
```

Download a specific file:

```bash
smbmap -H $TARGET_IP -u $USER -p $PASSWORD --download '$SHARE\path\to\file.txt'
```

## impacket-smbclient

Works well when smbclient has issues with SMB signing requirements or dialect negotiation. Also handles pass-the-hash directly:

```bash
impacket-smbclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP
```

Pass-the-hash:

```bash
impacket-smbclient -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP
```

The same `ls`, `cd`, `get`, and `mget` commands apply inside the session.

## Mounting Shares

Mounting gives access to local tools like `grep` and `find` against share contents:

```bash
sudo mkdir -p /mnt/smb
sudo mount -t cifs //$TARGET_IP/$SHARE /mnt/smb -o username=$USER,password=$PASSWORD,domain=$DOMAIN
```

Anonymous mount:

```bash
sudo mount -t cifs //$TARGET_IP/$SHARE /mnt/smb -o guest
```

After mounting, search for credential material:

```bash
grep -r -i 'password\|passwd\|secret\|connectionstring' /mnt/smb/ 2>/dev/null
find /mnt/smb -name "*.xml" -o -name "*.config" -o -name "*.ini" -o -name "*.ps1" 2>/dev/null
```

Unmount when done:

```bash
sudo umount /mnt/smb
```

## High-Value Shares

**SYSVOL and NETLOGON** on domain controllers contain Group Policy files and logon scripts. Check for `Groups.xml`, `Services.xml`, `Scheduledtasks.xml`, and `Datasources.xml`: these may contain `cpassword` values encrypted with a publicly documented Microsoft key:

```bash
find /mnt/smb -name "*.xml" 2>/dev/null | xargs grep -l "cpassword" 2>/dev/null
```

**Backup shares** frequently contain database dumps, configuration archives, and directory backups.

**IT and scripts shares** commonly hold PowerShell and batch scripts with hardcoded credentials.

High-value file types to look for when browsing shares:

- `.ps1`, `.bat`, `.vbs` scripts with hardcoded credentials
- `.xml` Group Policy Preferences files containing `cpassword`
- `.config`, `.ini` files with connection strings
- `.kdbx` KeePass databases and `.ppk` private keys
- `.bak`, `.sql` database dumps and backup archives

## References

- [Pennyw0rth/NetExec](https://github.com/Pennyw0rth/NetExec) - nxc SMB share listing, spidering, and content search
- [smb-enum-shares NSE Script](https://nmap.org/nsedoc/scripts/smb-enum-shares.html) - Nmap-based share enumeration
- [fortra/impacket](https://github.com/fortra/impacket) - impacket-smbclient for SMB access including pass-the-hash