SMB Clients

Two tools for browsing SMB shares interactively from Linux: the native Samba smbclient and the impacket smbclient.py. Both support password, NT hash, and Kerberos auth but with different syntax.

smbclient (native Samba)

The standard Samba tool. Available on every Kali/Parrot install. Use for quick share browsing, file transfer, and pass-the-hash.

Listing Shares

Password
NT Hash
Kerberos
Null Session

smbclient -L //$IP -U $DOMAIN/$USER%$PASSWORD

smbclient -L //$IP -U $DOMAIN/$USER%$NTHASH --pw-nt-hash

# Requires KRB5CCNAME set and hostname (not IP)
export KRB5CCNAME=/tmp/ticket.ccache
smbclient -L //$HOSTNAME -k

smbclient -L //$IP -N
smbclient -L //$IP -U ''%''

Password
NT Hash
Kerberos

smbclient //$IP/$SHARE -U $DOMAIN/$USER%$PASSWORD

smbclient //$IP/$SHARE -U $DOMAIN/$USER%$NTHASH --pw-nt-hash

export KRB5CCNAME=/tmp/ticket.ccache
smbclient //$HOSTNAME/$SHARE -k
smbclient //$HOSTNAME/$SHARE -k -U $USER

Non-Interactive (Single Commands)

# Run a single command and exit (-c flag)
smbclient //$IP/$SHARE -U $DOMAIN/$USER%$PASSWORD -c 'ls'
smbclient //$IP/$SHARE -U $DOMAIN/$USER%$PASSWORD -c 'get secrets.txt'
smbclient //$IP/$SHARE -U $DOMAIN/$USER%$PASSWORD -c 'put payload.exe'

# Recursive download of entire share
smbclient //$IP/$SHARE -U $DOMAIN/$USER%$PASSWORD \
  -c 'recurse; prompt off; mget *'

Interactive Session Commands

ls                        # list current directory
cd path                   # change directory
get file.txt              # download file
put local.txt             # upload file
recurse on                # enable recursive listing
prompt off                # disable confirmation prompts for mget/mput
mget *                    # download everything (run recurse + prompt first)
mput *                    # upload everything
del file.txt              # delete remote file
mkdir newdir              # create remote directory
exit                      # quit

Useful Flags

-N                        # no password (null/anonymous session)
-p PORT                   # custom port (default 445)
--signing=off             # disable SMB signing requirement
--max-protocol SMB2       # force SMB2
--option='client min protocol=NT1'  # force SMBv1 (legacy targets)

smbclient.py (impacket)

The impacket equivalent. Useful when native smbclient isn’t available or when you need impacket’s Kerberos handling. Shares the same auth flags as the rest of impacket.

Connecting

Password
NT Hash
Kerberos

# Opens interactive shell listing shares
smbclient.py $DOMAIN/$USER:$PASSWORD@$IP

# Connect directly to a specific share
smbclient.py $DOMAIN/$USER:$PASSWORD@$IP -share $SHARE

smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP
smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP -share $SHARE

# Hostname required — not IP
export KRB5CCNAME=/tmp/ticket.ccache
smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME -share $SHARE

Interactive Session Commands

shares                    # list available shares
use ShareName             # switch to a share
ls                        # list files in current directory
cd path                   # change directory
get file.txt              # download file
put local.txt             # upload file
cat file.txt              # print file contents
mkdir newdir              # create directory
rm file.txt               # delete file
info                      # show server info
exit                      # quit

Key Differences vs Native smbclient

Feature	smbclient	smbclient.py
NT Hash PTH	`--pw-nt-hash` flag	`-hashes :NT`
Kerberos	`-k` (system ccache)	`-k -no-pass` + `KRB5CCNAME`
Share selection	Path in URL (`//ip/share`)	`use ShareName` command or `-share` flag
Recursive download	`recurse on; mget *`	manual `get` per file
Availability	Installed by default	Requires impacket

smbcacls

Read and modify Windows DACLs on SMB shares from Linux. Useful for confirming write permissions before attempting ACL abuse or privilege escalation through share ACEs.

Syntax

smbcacls //$TARGET/$SHARE "path\to\object" [options] -U $DOMAIN/$USER%$PASSWORD

The path is relative to the share root using backslashes. Use an empty string "" for the share root itself.

Flags

Authentication

Flag	Description
`-U $DOMAIN/$USER%$PASSWORD`	Password authentication
`-N`	Null/anonymous session
`--no-pass`	Same as `-N`
`-k`	Kerberos auth from ccache

ACL Modification

Flag	Description
`-A acl`	Add an ACE to the DACL
`-M acl`	Modify an existing ACE
`-D acl`	Delete an ACE
`-S acl`	Replace the entire DACL
`-C owner`	Change owner
`-G group`	Change group
`--propagate-inheritance`	Cascade ACE changes to children
`-R`	Recurse into subdirectories

Reading ACLs

Password
Kerberos
Null Session

# Folder
smbcacls //$TARGET/$SHARE "$DOMAIN\scripts" -U $DOMAIN/$USER%$PASSWORD

# Specific file
smbcacls //$TARGET/$SHARE "$DOMAIN\scripts\login.vbs" -U $DOMAIN/$USER%$PASSWORD

# Share root
smbcacls //$TARGET/$SHARE "" -U $DOMAIN/$USER%$PASSWORD

KRB5CCNAME=$USER.ccache smbcacls //$TARGET/$SHARE "$DOMAIN\scripts" -k

smbcacls //$TARGET/$SHARE "$DOMAIN\scripts" -N

Reading the Output

REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:BUILTIN\Administrators
GROUP:NT AUTHORITY\SYSTEM
ACL:Everyone:ALLOWED/OI|CI/FULL

ACE format: PRINCIPAL:TYPE/INHERITANCE_FLAGS/RIGHTS

CONTROL Flags

Flag	Meaning
`SR`	Self-relative descriptor
`PD`	DACL protected (no inheritance from parent)
`DI`	DACL inherited
`DP`	DACL present

ACE Type

Value	Meaning
`ALLOWED`	Access allowed ACE
`DENIED`	Access denied ACE
`AUDIT`	Audit ACE

Inheritance Flags

Flag	Meaning
`OI`	Object Inherit: ACE propagates to child files
`CI`	Container Inherit: ACE propagates to child folders
`IO`	Inherit Only: applies to children, not the object itself
`NP`	No Propagate: do not inherit further down
`I`	ACE was inherited from parent

Rights

Value	Meaning
`FULL`	Full Control
`READ`	Read only
`CHANGE`	Read, Write, Execute (no ACL change)
`0x001F01FF`	Full control (raw bitmask)

What to Look for in Recon

ACL:Everyone:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL

IO on CREATOR OWNER is normal. It means the creator-owner ACE applies only to children they create, not the folder itself. Writing a file there does not grant you rights on the folder.

C2

Impacket Suite

NetExec

bloodyAD

smbclient (native Samba)

Listing Shares

Non-Interactive (Single Commands)

Interactive Session Commands

Useful Flags

smbclient.py (impacket)

Connecting

Interactive Session Commands

Key Differences vs Native smbclient

smbcacls

Syntax

Flags

Reading ACLs

Reading the Output

What to Look for in Recon

​smbclient (native Samba)

​Listing Shares

​Connecting to a Share

​Non-Interactive (Single Commands)

​Interactive Session Commands

​Useful Flags

​smbclient.py (impacket)

​Connecting

​Interactive Session Commands

​Key Differences vs Native smbclient

​smbcacls

​Syntax

​Flags

​Reading ACLs

​Reading the Output

​What to Look for in Recon

smbclient (native Samba)

Listing Shares

Connecting to a Share

Non-Interactive (Single Commands)

Interactive Session Commands

Useful Flags

smbclient.py (impacket)

Connecting

Interactive Session Commands

Key Differences vs Native smbclient

smbcacls

Syntax

Flags

Reading ACLs

Reading the Output

What to Look for in Recon