SMB Guest Access Detection

Guest access is different from a null session. A host can block anonymous RPC calls and still map unauthenticated users into a guest context for share access. When that happens, you can end up with direct file exposure without valid credentials, which is the part that matters. The -N flag tells smbclient to skip the password prompt. If the guest account is active, the server accepts the empty credential and returns results.

All three tools below take a different angle. smbclient -L lists share names as the server advertises them. SMBMap shows the actual permission level granted per share. nxc smb --shares combines both in one pass and is usually the fastest starting point. Start with the fast checks.

Testing for SMB Guest Access

If the host lists shares without credentials, test whether the access is actually usable. Share listing and file access are separate operations. A server can hand out the share list to anonymous callers and then deny access at the share or file level via a different ACL. The dir command confirms real traversal rights. Common shares exposed via guest access:

• Public, Shared, Files (general purpose)
• Backup, Temp, Drop (staging and transfer)
• SYSVOL, NETLOGON (misconfigured domain controllers)

SYSVOL and NETLOGON normally require domain credentials, but misconfigured servers sometimes expose them as guest-readable.

A successful dir means the share is not just visible. It is readable. That can expose documents, installers, scripts, exports, and operational data without any valid account. Scripts and batch files are a common find. They often contain hardcoded credentials or UNC paths pointing to other internal resources. Configuration files and database exports in backup or temp shares are also worth pulling.

Use SMBMap to separate simple visibility from real permissions. The -r flag recurses into subdirectories, which surfaces nested content a top-level dir misses. The output labels each share as READ ONLY or READ, WRITE. Prioritize shares with write access, but do not skip read-only shares until you have checked what is inside.

If the host only leaks names and denies file access, the issue is weaker and you can move on. If read access works, keep the exact share names and review them for sensitive content next. If write access works, the issue gets stronger because guest-backed file placement can become tampering or user-triggered execution later, depending on how that share is used.

If smbclient returns NT_STATUS_ACCESS_DENIED on listing, the guest account is likely disabled at the OS level. Some hosts enforce SMB signing or require NTLM authentication before revealing shares. If you get NT_STATUS_CONNECTION_REFUSED on port 139, add --port 445 to force the connection over TCP/445.

These checks generate SMB negotiation handshakes and appear in Windows Security event logs as logon attempts with an empty account name. Event ID 4624 (logon type 3, empty username) may trigger alerts on monitored hosts. Run one tool at a time if stealth matters, rather than all three in sequence.