SMBCLIENT
INSTALLATION
root@oco:~$ sudo apt install smbclient
LISTING SHARES: PASSWORD MISCONFIGURATION
#test whether the server have password misconfiguration
root@oco:~$ smbclient -h
root@oco:~$ smbclient -L {\\\\targetIP} -U {userName}
* the -L flag is used to list available server shares on the target.
* the -U flag is used to specify the Login identity to use.
- misconfigured smb servers typically have administrator as the username
with an unset password
LISTING SHARES: W/O PASSWORD
root@oco:~$ smbclient -h
root@oco:~$ smbclient -N -L \\\\10.129.42.253
Sharename Type Comment
-------- ---- -------
print$ Disk Printer Drivers
users Disk
IPC$ IPC IPC Service (gs-svcscan server (Samba, Ubuntu))
SMB1 disabled -- no workgroup available
* the -N (null session) is used for anonymous access
- it suppresses the input of existing users or valid passwords - password prompt
- the -N MUST come before the -L
* the -L is used to list available shares on the target
- do not use the -L when connecting to SMB; it is only for listing shares
* the print$ and an IPC$ are included by default in the basic setting (if configured)
ACCESSING SHARES: W/ FULL CREDENTIALS
CONNECTION: W/ PASSWORD
CONNECTION: W/ PASSWORD - WARNING
If you get the error "Unable to connect with SMB1..." then simply remove the -L from the command. smbclient -L tries to list workgroups that requires SMB1. Modern Windows systems disable SMB1, so the fallback fails
CONNECTION W/O PASSWORD
DOWNLOADING FILES
The smbclient allows for the execution of local system commands (non-target side)
EXECUTING LOCAL SYSTEM CMDS
The !<cmd> in smbclient will run a command in the local shell without leaving the smbclient interactive prompt. This executes on the system, not on the SMB server connected to. This is useful as it saves time when you want to manipulate local files (e.g., listing directories, moving files) while still staying inside the smbclient session.
Last updated