SMB Enumeration

Checking for Null session

smbclient -N -L $ip

# for connection:
# Example:
smbclient "//<IP>/scripts" -U "neha.com\icon%DRtajyCwcbWvH/9"

smbclient //[ip]/[share] -U [domain.com\username%password]

smbmap -H $ip -u 'anonymous' -p 'anonymous' -d "domain.com"
smbmap -H $ip -u guest -p '' 

# To list share with permission
netexec smb $ip -u guest -p '' --shares 

nmap --script smb-brute.nse -p445 $ip

enum4linux -a $ip

To download all files in a share

# First connect to the share.
# smbclient //[ip]/[share] -U [domain.com\username%password]
smb: \> RECURSE ON
smb: \> PROMPT OFF
smb: \> mget *

# This will download all files in that share.

Checking for Common vulnerability (Nmap)

nmap --script smb-vuln* -p 139,445 $ip

Help Links

PWK Notes: SMB Enumeration Checklist [Updated]0xdf hacks stuff

Page not found - HackTricksbook.hacktricks.xyz

https://exploit-notes.hdks.org/exploit/windows/active-directory/smb-pentesting/exploit-notes.hdks.org