smbmap Cheatsheet

SMB enumeration tool for listing shares, permissions, and contents.

Basic Syntax

smbmap [options] -H <host>

Option	Description	Example
`-H HOST`	Target host	`smbmap -H 10.10.10.10`
`-P PORT`	SMB port (default 445)	`smbmap -H 10.10.10.10 -P 139`
`-u USER`	Username	`smbmap -u admin -H 10.10.10.10`
`-p PASS`	Password	`smbmap -u admin -p Password123 -H 10.10.10.10`
`-d DOMAIN`	Domain	`smbmap -u admin -p pass -d MYDOMAIN -H 10.10.10.10`

smbmap -H 10.10.10.10 -u '' -p ''

smbmap -H 10.10.10.10 -u 'guest' -p ''

smbmap -H 10.10.10.10 -u admin -p 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'

Option	Description	Example
`-r PATH`	Recursively list directory	`smbmap -r C$ -H 10.10.10.10 -u admin -p pass`
`-R PATH`	List shares recursively	`smbmap -R -H 10.10.10.10 -u admin -p pass`
`--depth N`	Recursive depth (default 5)	`smbmap -R --depth 3 -H 10.10.10.10`
`-A PATTERN`	Download files matching pattern	`smbmap -A '*.txt' -R -H 10.10.10.10`
`-q`	Quiet mode (suppress banner)	`smbmap -q -H 10.10.10.10`

Option	Description	Example
`--download PATH`	Download file	`smbmap --download 'C$\file.txt' -H 10.10.10.10 -u admin -p pass`
`--upload SRC DST`	Upload file	`smbmap --upload payload.exe 'C$\payload.exe' -H 10.10.10.10 -u admin -p pass`
`--delete PATH`	Delete file	`smbmap --delete 'C$\file.txt' -H 10.10.10.10 -u admin -p pass`

Option	Description	Example
`-x CMD`	Execute command	`smbmap -x 'ipconfig' -H 10.10.10.10 -u admin -p pass`
`--mode psexec`	Use PsExec method	`smbmap -x 'whoami' --mode psexec -H 10.10.10.10`

smbmap -H 10.10.10.10 -u admin -p Password123

Output shows share permissions:

smbmap -H 10.10.10.10 -u admin -p Password123 -r 'Share Name'

smbmap -H 10.10.10.10 -u admin -p Password123 -R --depth 3

smbmap -H 10.10.10.10 -u admin -p Password123 -R -A '\.txt$'

smbmap -H 10.10.10.0/24 -u admin -p Password123

Permission	Description
`READ ONLY`	Can read files
`READ, WRITE`	Full access
`NO ACCESS`	Access denied
`ADMIN$`	Administrative share (requires admin)
`C$`	Default drive share (requires admin)
`IPC$`	Inter-process communication