smbclient //$IP/$SHARE -U $USER -p $PORT

• -I - IP address to connect to
• -U - username to use for the connection
• -P - password to use for the connection
• -N - attempt to connect without a password
• -W - domain (or workgroup) to use for the connection
• -p - connect to a non-standard port
• -c - attempt to execute the supplied command (!!!) on the server (if the user you’re connecting as has permission to do so)

The -p directive is only necessary if working over a non-standard port (e.g., not 445).

If -U is not included, smbclient will use your current (local) username, so probably best to fill something else in. If a password needs to be sent, specify the user as ${USER}%${PASSWORD}.

The interface is reminiscent of old-school FTP clients.

Reconnaissance

Samba services can be enumerated by smbclient using:

smbclient -L $SERVER_NAME -I $IP_ADDRESS

Here $SERVER_NAME is the machine’s NetBIOS domain name, which can be found with enum4linux.