smbmap

SMBMap was designed with penetration testing in mind to simplify searching for potentially sensitive data across large networks. It enumerates Samba shares, checks permissions, and provides features like pass-the-hash support, file upload/download/delete, permission enumeration compatible with Metasploit, remote command execution, distributed file content searching, file name matching with auto-download, and SMB signing detection.

Use cases include listing available shares and their permissions on target hosts, recursively exploring share contents, searching for specific file patterns or content, executing commands remotely, and interacting with filesystems via upload, download, or delete operations. It supports Kerberos authentication and works with IPs, hostnames, or CIDR ranges from host files.

The tool requires admin rights for advanced features like drive listing or command execution and is particularly useful in Windows environments for identifying writable shares and potential data exfiltration points.

SMBMap establishes SMB sessions over port 445 to enumerate shares, permissions, and contents using SMB protocols. It supports authenticated sessions with usernames/passwords or NTLM hashes (pass-the-hash), null sessions, and Kerberos. Features like recursive listing, file content search via PowerShell execution, and filesystem operations leverage SMB file access and remote command execution methods (WMI or PSEXEC). It detects SMB signing, server versions, and handles distributed searches across hosts.