# Smbclient

> Use for SMB share review and file access validation during authorized internal assessments. Trigger on share enumeration, authenticated access checks, and confirming Windows file exposure within approved scope.

- Skill: `timsonner/smbclient` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/smbclient`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/smbclient/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/smbclient

---


# Smbclient

## Purpose

Use this skill for direct SMB share inspection after a Windows target has already been identified.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to enumerate accessible SMB shares.
- Need to confirm whether a share exposes material data or weak permissions.
- Need to validate what an approved credential can read from a specific share.

## Avoid When

- The target host is out of scope.
- Share access could expose unnecessary sensitive data beyond the approved proof path.

## Inputs

- Approved Windows host and optional share name
- Anonymous or credentialed access context
- Evidence handling limits for file access

## Procedure

1. Start with share listing before opening content.
2. Access only the minimum directories needed to prove risk.
3. Record permission differences between anonymous and authenticated access.
4. Avoid unnecessary file retrieval.
5. Preserve the exact host, share, and credential context for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# List shares (null session)
smbclient -L //10.10.10.100 -N

# List shares with credentials
smbclient -L //10.10.10.100 -U 'contoso\auditor%<password>'

# Connect to a specific share
smbclient //10.10.10.100/SYSVOL -U 'contoso\auditor%<password>'

# Recursively download all files from a share
smbclient //10.10.10.100/SHARE -U 'contoso\auditor%<password>' -c 'recurse; prompt off; mget *'

# Connect to a domain controller by name
smbclient //dc01.contoso.com/NETLOGON -U 'CONTOSO\auditor%<password>'

# Unauthenticated IPC$ access check
smbclient //10.10.10.100/IPC$ -N
```

## Evidence to Capture

- Accessible shares and their effective access level
- Specific directories that prove the exposure
- Exact credential context used during validation

## Safety Boundaries

- Do not browse or copy more data than necessary.
- Stop if the target shows lockout, alerting, or instability behavior.