Skip to main content

SMB | Port 139,445

Enumerating SMB quick methods

Get the host name or Netbios Name​

  1. nmblookup
nmblookup -A $IP
  1. nbtscan
nbtscan $IP
  1. Nmap Script
nmap --script=nbstat $IP -p139,445
  1. nbtstat

when enumearting form a windows machine

nbtstat -A $IP

SMB Share and Null Session​

  1. smbmap

listing shares

smbmap -H $IP
  1. smbmap

User specific Share enum

smbmap -H $IP -u $USER -p $PASS
  1. smbclient

listing Shares

smbclient -L $IP

accessing share without user & Pass

smbclient //$IP/Sharename

listing and accessing user specific share

smbclient -L $IP -U USER%PASS
smbclient //$IP/share -U USER%PASS
  1. Nmap Script

Listing of the shares using NSE script

nmap --script smb-enum-shares -p139,445 $IP
  1. CrackMapExec

_ Automated enumeration of shares_

crackmapexec smb 192.168.1.17 -u '' -p '' --shares

Username and Password can be passed if you already have.

References​

  1. Hacking Articles this is great resource for more details on this service.