SMB

root@htb:~$ smbclient -h
root@htb:~$ smbclient -N -L \\\\{TARGET_IP}\\

 * the -N refers to "no password"
 * the -L is used to list available shares on the target
 
root@htb:~$ smbclient -N \\\\{targetIP}\\{shareName}$

 * the $ symbol at the end of the sharename means that it is an administrative share