Skip to content
HackIndex logo

HackIndex

Writable SMB Shares Detection

2 min read Mar 6, 2026

Writable SMB shares matter because they turn access into placement. That can be low-value file staging, or it can become script replacement, software tampering, or a path to later code execution if users or services trust content from that share. SMBMap is built for permission review, recursive listing, and upload or download workflows, which makes it the fastest way to validate this cleanly.

Start with a permission review.

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -U "$USER%$PASSWORD"

If a share shows write access, confirm it directly.

┌──(kali㉿kali)-[~]
└─$ echo test > /tmp/smb_write_test.txt
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Shared -U "$USER%$PASSWORD" -c "put /tmp/smb_write_test.txt smb_write_test.txt; dir"

For guest-backed testing:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/Public -N -c "put /tmp/smb_write_test.txt smb_write_test.txt; dir"

The write is confirmed when the file appears in the remote listing. That matters more than a tool saying WRITE, because you now know the share really accepts uploaded content.

Check the surrounding directories before you decide impact.

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u "$USER" -p "$PASSWORD" -r
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -r

If the writable path is just a public drop folder, document it but keep the impact realistic. If it sits in login scripts, software deployment, profile storage, or another trusted path, raise it immediately because writable content in those locations often supports lateral movement or execution chains later.

References