This is a list of useful commands/tricks using smbclient, enum4linux and nmap smb scripts - very useful on a pentesting https://sharingsec.blogspot.com

smbclient -L

smbclient -L <target-IP> -U username%password

smbclient //<target>/<share$> -U username%password

smbclient //<target>/<share$> -c 'ls' password -U username

smbclient //<target>/<share$> -c 'cd folder; ls' password -U username

smbclient //<target>/<share$> -c 'cd folder;get desired_file_name' password -U username

smbclient //<target>/<share$> -c 'put /var/www/my_local_file.txt .\target_folder\target_file.txt' password -U username

smbclient //<target>/<share$> -c 'mkdir .\target_folder\new_folder' password -U username

smbclient //<target>/<share$> -c 'rename current_file.txt new_file.txt' password -U username

enum4linux -a <target>

enum4linux -a <target> -u <user> -p <pass>

enum4linux -u <user> -p <pass> -U <target>

enum4linux -u <user> -p <pass> -G <target>

enum4linux -u <user> -p <pass> -P <target>

nmap -p 445 --script smb-enum-users <target> --script-args smbuser=username,smbpass=password,smbdomain=domain nmap -p 445 --script smb-enum-users <target> --script-args smbuser=username,smbhash=LM:NTLM,smbdomain=domain

nmap --script smb-enum-users.nse --script-args smbusername=User1,smbpass=Pass@1234,smbdomain=workstation -p445 192.168.1.10

nmap --script smb-enum-users.nse --script-args smbusername=User1,smbhash=aad3b435b51404eeaad3b435b51404ee:C318D62C8B3CA508DD753DDA8CC74028,smbdomain=mydomain -p445 192.168.1.10

nmap -p 445 --script smb-enum-groups <target> --script-args smbuser=username,smbpass=password,smbdomain=domain nmap -p 445 --script smb-enum-groups <target> --script-args smbuser=username,smbhash=LM:NTLM,smbdomain=domain

nmap -p 445 --script smb-enum-shares <target> --script-args smbuser=username,smbpass=password,smbdomain=domain nmap -p 445 --script smb-enum-shares <target> --script-args smbuser=username,smbpass=LM:NTLM,smbdomain=domain

nmap -p 445 --script smb-os-discovery <target>

nmap -p 445 --script smb-vuln-ms06-025 target-IP
nmap -p 445 --script smb-vuln-ms07-029 target-IP
nmap -p 445 --script smb-vuln-ms08-067 target-IP
nmap -p 445 --script smb-vuln-ms10-054 target-IP
nmap -p 445 --script smb-vuln-ms10-061 target-IP
nmap -p 445 --script smb-vuln-ms17-010 target-IP
nmap -p 445 --script smb-vuln-cve-2017-7494 target-IP

-- Always check for updated list on https://nmap.org/nsedoc/scripts/

nmap –p 445 --script smb-brute –script-args userdb=user-list.txt,passdb=pass-list.txt target-IP