For a series of targets (IPs), Id like to determine which SMB shares my account has no access to, which it has read access to, and which it has read/write access to.

Currently I am using smbclient. The command I run first is

smbclient -L [targetIP] -U [user] -p 445

This gives me a list of shares. For example;

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        print$          Disk      Printer Drivers
        MySecrets       Disk

I then can connect to a file share with this command

smbclient //[target]/[name_of_share_from_list] -U [user] -p 445

Which results in an SMB prompt. From the prompt I type ls and if I see files I know I have read access. I'm guessing I have to push a file to see if I have write access.

This is tedious. How do I automate this such that for the given list of targets, I get a list of all shares, and the level of access my account has to them?


You had much of the work already in place. Reading the man page for smbclient would have given you the -c <command> parameter, which can be used to provide one or more commands directly rather than interactively.

username="DOMAIN\\USER"    # Double backslash
password="PASSWORD"        # For demonstration purposes only
hostname="TARGET_HOST"     # SMB hostname of target

cd "${TMPDIR:-/tmp}"
touch tmp_$$.tmp           # Required locally to copy to target

smbclient -L "$hostname" -g -A <( echo "username=$username"; echo "password=$password" ) 2>/dev/null |
    awk -F'|' '$1 == "Disk" {print $2}' |
    while IFS= read -r share
        echo "Checking root of share '$share'"

        if smbclient "//$hostname/$share/" "$password" -U "$username" -c "dir" >/dev/null 2>&1

            # Try uprating to read/write
            if smbclient "//$hostname/$share/" "$password" -U "$username" -c "put tmp_$$.tmp ; rm tmp_$$.tmp" >/dev/null 2>&1

        case "$status" in
            READ) echo "Well, $username has read access" ;;
            WRITE) echo "Yes, $username has write access" ;;
            *) echo "No, $username has no access" ;;

rm -f tmp_$$.tmp
  • Ah i was wondering if id have to resort to a bash script like this. I havent written one yet but this may give me a good starting point. Can you edit this to output if i have read access only? – n00b May 30 '17 at 15:28
  • In addition to the check for write as well i mean – n00b May 30 '17 at 15:29
  • @n00b. You could change the second echo putting the message "$username has read-only access to the root of this share". Unless you are also scanning directories that you have no read access at all... – user34720 May 30 '17 at 20:16
  • The later is the case. I dont know if I have read access, and would rather have the option to 'try writing' after knowing if I have read access first. In otherwords, tell me if I have read first, then tell me if I have write. Is that possible? – n00b May 30 '17 at 21:06
  • 1
    @roaima I did. I saved it in a script.sh file, ran the chmod 755 script.sh command then am trying to execute ./script.sh but it just sits and sits. I added echo 'breadcrumbs' and the echos execute up until the smbclient line – n00b Jul 5 '17 at 21:14

Maybe SMBmap can help you with this tastk. Its author developed it precisely for that purpose.

$  python smbmap.py -H [targetIP] -u [user] -P 445
[+] Finding open SMB ports....
[+] User SMB session establishd...
[+] IP: Name:
        Disk                                                    Permissions
        ----                                                    -----------
        ADMIN$                                                  READ, WRITE
        C$                                                      READ, WRITE
        IPC$                                                    NO ACCESS
        TMPSHARE                                                READ, WRITE     

You can use --host-file to pass a list of targets.

Internally, it tries to create a directory with a random name to check if we have write permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.