SMB Pentest

 SMB Enum Scripts and Checklists

Enumerating SMB Shares

my $host = "10.10.10.10";
my $filename = "/usr/share/wordlists/SecLists/blob/master/Discovery/Web-Content/common.txt";
open(my $fh, '<', $filename) or die $!;
while (my $word = <$fh>) {
    chomp($word);
    
    ## Try to login with a username and no password
    my $result = qx( smbclient //$host/$word -N 2>/dev/null );
    ## ACCESS_DENIED means the share exists
    ## BAD_NETW_NAME means the share does not exist
    if ($result =~ /NT_STATUS_ACCESS_DENIED/g ) {
        print "[+] Share Found @ //$host/$word\n";
        next;
    }
}