E-SMB
smbclient
FTP-like command-line client, bundled with Samba, for browsing and interacting with SMB/CIFS shares.
OVERVIEW
smbclient ships as part of the Samba suite (samba.org) and works like an interactive FTP client for the SMB/CIFS protocol: point it at a host to list available shares, then connect to one to browse directories, download or upload files, and run basic share-level commands (get, put, ls, mget).
It is often the first tool used to manually confirm what enum4linux-ng, Nmap's smb-enum-shares script, or crackmapexec already flagged, since it gives a direct, interactive view of what a given set of credentials — or no credentials at all — can actually read.
USE CASES
Practical use cases
- 01
Listing the shares exposed by a host and confirming which ones are actually browsable.
- 02
Manually reading or downloading files from a share flagged as sensitive by an automated scan.
- 03
Testing whether an anonymous (null-session) or guest connection can read a given share.
- 04
Validating credential access to a specific share before scripting a bulk pull with another tool.
QUICK START
Once a share name is known (from Nmap, enum4linux-ng, or a listing) to connect interactively and confirm what is actually accessible and readable.
- Confirm SMB access to this host is within the agreed scope.
- List available shares with an anonymous connection first (-N).
- Connect to a specific share, with credentials if anonymous access is refused and creds are in scope.
- Browse with ls, and pull anything relevant with get or mget.
- Note exactly which files and shares were accessed for the report.
smbclient -L //10.10.10.10 -NBEFORE YOU RUN IT
What to check before running it
Anonymous (-N) listing is disabled on modern Windows and hardened Samba by default, so an empty share list there is expected, not a failure of the tool.
Every connection, listing, and file access is typically logged by the target and any EDR watching SMB traffic — treat it as visible, not stealthy.
Downloading files from a share is data access: only pull what the rules of engagement authorize, and handle anything sensitive per the client's NDA.