Skip to content
HackIndex logo

HackIndex

SMB Guest Access Detection

2 min read Mar 6, 2026

Guest access is different from a null session. A host can block anonymous RPC calls and still map unauthenticated users into a guest context for share access. When that happens, you can end up with direct file exposure without valid credentials, which is the part that matters. smbclient and SMBMap both support unauthenticated share testing.

Start with the fast checks.

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -N
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP --shares

If the host lists shares without credentials, test whether the access is actually usable.

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Public -N -c "dir"
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Shared -N -c "dir"

A successful dir means the share is not just visible. It is readable. That can expose documents, installers, scripts, exports, and operational data without any valid account.

Use SMBMap to separate simple visibility from real permissions.

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -r

If the host only leaks names and denies file access, the issue is weaker and you can move on. If read access works, keep the exact share names and review them for sensitive content next. If write access works, the issue gets stronger because guest-backed file placement can become tampering or user-triggered execution later, depending on how that share is used.

References