> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/filesystem-search/trick-0271.md).

# Authenticated SMB Share File Discovery

***

`smbclient` is an ftp-like client used to access SMB/CIFS resources on servers. Using `smbclient` with compromised credentials allows you to access network shares. Before connecting to a specific share, you can list available shares on a target IP address.

To display public shares on the server, you can use the `-L` flag with `-U%`:

```bash
smbclient -L <host> -U%
```

To list shares anonymously (null session), you can use the `-L` flag with the `-N` flag:

```bash
smbclient -L //IP -N
```

If anonymous access is not allowed but you have credentials, you can list shares using the `-L` flag with the `-U` flag specifying the username and password:

```bash
smbclient -L //IP -U username%password
```

Once you know the share name, you can connect to it. To connect to a specific share anonymously, use:

```bash
smbclient //IP/share -N
```

Using the username and password directly in the command line is also possible, as shown in the original example connecting to the `backup` share:

```bash
smbclient \\\\10.10.186.106\\backup --user svc-admin --password mana**********
```

Alternatively, you can provide credentials using the `-U` flag when connecting to a share:

```bash
smbclient //IP/share -U username%password
```

Another way to connect using the username and password with the `-U` flag is:

```bash
smbclient //<host>/<share> -U<user>%<pas...
```

Once authenticated and connected to a share, you enter an interactive shell. This shell is similar to an FTP client. In this shell, you can list files and directories using the `ls` command. You can navigate directories using `cd`. To download specific files, use the `get` command. For example, to download a file named `backup_credentials.txt`:

```
get backup_credentials.txt
```

To upload files, you can use the `put` command. To exit the interactive shell, use the `exit` command. Search for sensitive information like configuration files or credential dumps within the accessible shares. Remember to check standard shares like ADMIN$, C$, NETLOGON, and SYSVOL, as well as any other custom shared folders discovered during the listing phase.