73 lines
5.7 KiB
Markdown
73 lines
5.7 KiB
Markdown
---
|
|
obj: application
|
|
repo: https://github.com/ShawnDEvans/smbmap
|
|
source: https://www.kali.org/tools/smbmap
|
|
---
|
|
|
|
# smbmap
|
|
SMBMap allows users to enumerate [samba](../web/Samba.md) share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and is intended to simplify searching for potentially sensitive data across large networks.
|
|
|
|
## Usage
|
|
Usage: `smbmap [options]...`
|
|
|
|
### Options
|
|
#### Main arguments
|
|
| Option | Description |
|
|
| ------------------------ | --------------------------------------------------- |
|
|
| `-H HOST` | IP of host |
|
|
| `--host-file FILE` | File containing a list of hosts |
|
|
| `-u USERNAME` | Username, if omitted null session assumed |
|
|
| `-p PASSWORD` | Password or NTLM hash |
|
|
| `--prompt` | Prompt for a password |
|
|
| `-s SHARE` | Specify a share |
|
|
| `-d DOMAIN` | Domain name (default WORKGROUP) |
|
|
| `-P PORT` | SMB port (default 445) |
|
|
| `-v` | Return the OS version of the remote host |
|
|
| `--admin` | Just report if the user is an admin |
|
|
| `--no-banner` | Removes the banner from the top of the output |
|
|
| `--no-color` | Removes the color from output |
|
|
| `--no-update` | Removes the "Working on it" message |
|
|
| `--timeout SCAN_TIMEOUT` | Set port scan socket timeout. Default is .5 seconds |
|
|
|
|
#### Command Execution
|
|
Options for executing commands on the specified host
|
|
|
|
| Option | Description |
|
|
| ---------------- | ---------------------------------------------------------- |
|
|
| `-x COMMAND` | Execute a command ex. `ipconfig /all` |
|
|
| `--mode CMDMODE` | Set the execution method, `wmi` or `psexec`, default `wmi` |
|
|
|
|
#### Shard drive Search
|
|
Options for searching/enumerating the share of the specified host(s)
|
|
|
|
| Option | Description |
|
|
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| `-L` | List all drives on the specified host, requires ADMIN rights. |
|
|
| `-r [PATH]` | Recursively list dirs and files (no share\path lists the root of ALL shares), ex. 'email/backup' |
|
|
| `-A PATTERN` | Define a file name pattern ([regex](../../tools/Regex.md)) that auto downloads a file on a match (requires `-r`), not case sensitive, |
|
|
| `-g FILE` | Output to a file in a grep friendly format, used with `-r` (otherwise it outputs nothing) |
|
|
| `--csv FILE` | Output to a [CSV](../../files/CSV.md) file |
|
|
| `--dir-only` | List only directories, ommit files. |
|
|
| `--no-write-check` | Skip check to see if drive grants WRITE access. |
|
|
| `-q` | Quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when performing a search. |
|
|
| `--depth DEPTH` | Traverse a directory tree to a specific depth. (Default: 5) |
|
|
| `--exclude SHARE [SHARE ...]` | Exclude share(s) from searching and listing |
|
|
|
|
#### File Content Search
|
|
Options for searching the content of files (must run as root), kind of experimental
|
|
|
|
| Option | Description |
|
|
| -------------------------- | ------------------------------------------------------------------------------------------------------------------ |
|
|
| `-F PATTERN` | File content search, `-F '[Pp]assword'` (requires admin access to execute commands, and PowerShell on victim host) |
|
|
| `--search-path PATH` | Specify drive/path to search |
|
|
| `--search-timeout TIMEOUT` | Specifcy a timeout (in seconds) before the file search job gets killed. Default is 300 seconds. |
|
|
|
|
#### Filesystem interaction
|
|
Options for interacting with the specified host's filesystem
|
|
|
|
| Option | Description |
|
|
| ----------------------- | -------------------------------------- |
|
|
| `--download PATH` | Download a file from the remote system |
|
|
| `--upload SRC DST` | Upload a file to the remote system |
|
|
| `--delete PATH TO FILE` | Delete a remote file |
|
|
| `--skip` | Skip delete file confirmation prompt |
|