# Smbmap

> Use for SMB share and permission enumeration during authorized internal pentests. Trigger on validating share exposure, write access, and effective permissions across approved Windows hosts.

- Skill: `timsonner/smbmap` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/smbmap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/smbmap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/smbmap

---


# SMBMap

## Purpose

Use this skill for focused SMB share and permission review when the engagement needs a clear view of effective access across approved Windows targets.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to enumerate shares and effective permissions quickly.
- Need to verify write access or sensitive share exposure.
- Need a repeatable retest after SMB hardening.

## Avoid When

- Host scope or credential handling rules are unclear.
- File interaction would exceed the approved proof path.

## Inputs

- Approved host or host set
- Authorized credential context
- Share-scope and evidence limits

## Procedure

1. Start with enumeration before any file interaction.
2. Record only the shares and permissions that materially affect risk.
3. Validate write access only when necessary and approved.
4. Correlate findings with asset ownership and data sensitivity.
5. Preserve the exact host and auth context for retest.

## Command Syntax

Replace sample targets with approved in-scope hosts and credentials.

```bash
# List shares (null session)
smbmap -H 10.10.10.100

# List shares with credentials
smbmap -H 10.10.10.100 -u auditor -p '<password>' -d contoso.com

# Recursively list a specific share
smbmap -H 10.10.10.100 -u auditor -p '<password>' -d contoso.com -r SYSVOL

# Pass-the-Hash
smbmap -H 10.10.10.100 -u administrator -p '<NTLM_hash>' -d contoso.com

# Scan a subnet for accessible shares
smbmap -H 10.10.10.0/24 -u auditor -p '<password>'

# Download a file
smbmap -H 10.10.10.100 -u auditor -p '<password>' --download 'SHARE\path\to\file.txt'
```

## Evidence to Capture

- Shares and permission levels that materially affect risk
- Exact host and credential context used
- Minimal proof path for remediation or retest

## Safety Boundaries

- Keep host scope narrow and file interaction minimal.
- Do not browse or copy more data than necessary.