smbclient Cheatsheet

SMB/CIFS client for accessing Windows shares from Linux.

Basic Syntax

smbclient [options] //server/share

Option	Description	Example
`-L`	List available shares	`smbclient -L //10.10.10.10`
`-N`	No password (null session)	`smbclient -N -L //10.10.10.10`
`-U USER`	Specify username	`smbclient -U admin //10.10.10.10/share`
`-W DOMAIN`	Specify domain/workgroup	`smbclient -W MYDOMAIN -U admin //10.10.10.10/share`
`-p PORT`	Specify port	`smbclient -p 139 //10.10.10.10/share`
`-I IP`	Specify destination IP	`smbclient -I 10.10.10.10 //server/share`

Option	Description	Example
`-U user%pass`	Username and password	`smbclient -U admin%Password123 //10.10.10.10/share`
`-A authfile`	Auth file (user/pass/domain)	`smbclient -A creds.txt //10.10.10.10/share`
`--pw-nt-hash`	Use NT hash instead of password	`smbclient -U admin --pw-nt-hash //10.10.10.10/share`

smbclient -N -L //10.10.10.10

smbclient //10.10.10.10/sharename -U username

smbclient //10.10.10.10/sharename -U 'DOMAIN\username'

Once connected, use these commands:

Command	Description
`ls`	List files in current directory
`cd DIR`	Change directory
`pwd`	Print current directory
`get FILE`	Download file
`mget PATTERN`	Download multiple files
`put FILE`	Upload file
`mput PATTERN`	Upload multiple files
`mkdir DIR`	Create directory
`rmdir DIR`	Remove directory
`rm FILE`	Delete file
`recurse`	Toggle recursive mode for mget/mput
`prompt`	Toggle prompting for mget/mput
`exit`	Disconnect

smbclient //10.10.10.10/share -U user%pass -c 'recurse; prompt; mget *'

smbclient //10.10.10.10/share -U user%pass -c 'ls'

smbclient //10.10.10.10/share -U user%pass -c 'get secrets.txt'

smbclient //10.10.10.10/share -U user%pass -c 'put payload.exe'

smbclient //10.10.10.10/share -U admin --pw-nt-hash -W DOMAIN
# Then enter NT hash when prompted

Create a file with credentials:

username = admin
password = Password123
domain = MYDOMAIN

Use with: smbclient -A authfile //server/share