Tutorials

1. INTRODUCTION

SMBMap is a powerful SMB enumeration tool used to:

Common in:

2. BASIC ENUMERATION

List SMB shares on a host:

Example:

3. AUTHENTICATED ENUMERATION

Provide username and password:

Null session (guest / anonymous):

4. LIST SHARE PERMISSIONS

Show read/write/execute permissions:

Permissions meaning:

- R : read

- W : write

- X : execute

5. SEARCH FOR SPECIFIC FILES

Search recursively for files containing a keyword:

Example:

6. DOWNLOAD FILES

Download a file from a share:

Example:

7. UPLOAD FILES (IF WRITE ACCESS)

Upload a local file to a writable share:

Used for:

- Privilege escalation scripts

- Planting payloads in labs/CTFs

8. RECURSIVE SHARE ENUMERATION

List all files recursively:

Useful to discover:

- Password files

- Backups

- Configuration files

- Sensitive notes

9. CHECK ACCESS TO A SPECIFIC SHARE

Test permission for a single share:

10. EXECUTE COMMANDS (IF SERVER ALLOWS)

Some Windows hosts allow RCE via anonymous or authenticated IPC$.

Execute a command:

Used for:

- Foothold on Windows machines

- Testing SMB-to-RCE vulnerabilities

11. BRUTE-FORCE TESTING

Try multiple usernames/passwords:

Useful for:

- Weak domain credentials

- User enumeration in AD environments

12. COMBINING WITH OTHER TOOLS

SMBMap works well with:

- enum4linux : enumerate users/groups

- crackmapexec : large-scale SMB testing

- nmap --script smb* : vulnerability detection

13. FULL CTF WORKFLOW

1. Enumerate shares:

2. Try null session:

3. Identify share permissions.

4. Recursively list files:

5. Download interesting files (creds, configs, backups):

6. Upload payload if write access exists.

7. Try command execution:

8. Pivot using gained credentials:

- RDP

- WinRM

- SMB

- SSH