Enumerate SMB with enum4linux-ng#
enum4linux-ng -A $IP
Run nmap SMB scripts#
nmap --script=smb-enum* -p 139,445 $IP
Test SMB with NetExec#
netexec smb $IP
List shares as null user#
smbclient -N -L //$IP/
netexec smb $IP -u '' -p '' --shares
Connect to a share#
smbclient //$IP/sharename -U username
Mount a share locally#
mount -t cifs //$IP/sharename /mnt/smb -o username=user,password=pass
Recursively download a share#
smbclient //$IP/share -N -c "prompt OFF; recurse ON; mget *"