> For the complete documentation index, see [llms.txt](https://f1shh.gitbook.io/pentest-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1shh.gitbook.io/pentest-tips/recon/smb.md).

# SMB Enumeration

## Enum4Linux

**Scan a bunch of stuff:**

```bash
enum4linux -A <ip>
```

**Authenticated scan:**

```bash
enum4linux -u <username> -p <password> -U <ip>
```

**Verbose mode:**

```bash
enum4linux -v <ip>
```

## NMAP

**Shares and users:**

```bash
nmap -p445 --script=smb-enum-shares.nse,smb-enum-users.nse <ip>
```

**Run all smb scripts:**

```bash
nmap --script=smb-enum-* <ip>
```

**SMB Vuln Scan**

```bash
nmap --script smb-vuln* <ip>
```

## SMBClient

**Login using creds:**

```bash
smbclient //<ip>/<share> -u <username>
```

**Don't have creds?**

```bash
smbclient //<ip>/<share> -N
```

**Command Not working?**

```bash
smbclient //10.11.1.111/ --option='client min protocol=NT1'
```

**Stupid Win**

```
smbclient.py -no-pass Administrator@10..10.10.10 -port 445
```

### SMBClient commands

| Command                                    | Description                 |
| ------------------------------------------ | --------------------------- |
| get \<filename>                            | Gets a file from the server |
| put \<local file name> \<remote file name> | uploads file to server      |