timsonner Smbclient
Purpose
Use this skill for direct SMB share inspection after a Windows target has already been identified.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need to enumerate accessible SMB shares.
- Need to confirm whether a share exposes material data or weak permissions.
- Need to validate what an approved credential can read from a specific share.
Avoid When
- The target host is out of scope.
- Share access could expose unnecessary sensitive data beyond the approved proof path.
Inputs
- Approved Windows host and optional share name
- Anonymous or credentialed access context
- Evidence handling limits for file access
Procedure
- Start with share listing before opening content.
- Access only the minimum directories needed to prove risk.
- Record permission differences between anonymous and authenticated access.
- Avoid unnecessary file retrieval.
- Preserve the exact host, share, and credential context for retest.
Command Syntax
Replace sample targets with approved in-scope assets and authorized credentials.
# List shares (null session)
smbclient -L //10.10.10.100 -N
# List shares with credentials
smbclient -L //10.10.10.100 -U 'contoso\auditor%<password>'
# Connect to a specific share
smbclient //10.10.10.100/SYSVOL -U 'contoso\auditor%<password>'
# Recursively download all files from a share
smbclient //10.10.10.100/SHARE -U 'contoso\auditor%<password>' -c 'recurse; prompt off; mget *'
# Connect to a domain controller by name
smbclient //dc01.contoso.com/NETLOGON -U 'CONTOSO\auditor%<password>'
# Unauthenticated IPC$ access check
smbclient //10.10.10.100/IPC$ -N
Evidence to Capture
- Accessible shares and their effective access level
- Specific directories that prove the exposure
- Exact credential context used during validation
Safety Boundaries
- Do not browse or copy more data than necessary.
- Stop if the target shows lockout, alerting, or instability behavior.