Reviewed October 21, 2026. Commands are examples for an authorized, isolated lab; no target results are asserted here.
An SMB checklist is useful only if it separates the operations you actually tested. A hostname is not a share, a returned share name is not file access, and a failed request does not establish that no shares exist. Start with the last successful stage and the first failed operation.
Five checkpoints, with enumeration kept separate
| Checkpoint | What to record | What remains unproved |
|---|---|---|
| Transport | Target address, TCP port and connection result | An open listener does not prove a usable SMB session. |
| Negotiate | Chosen dialect or exact negotiation error | A dialect is not a Samba package version. |
| Session setup | Requested identity and authentication result | A successful session does not grant every share operation. |
| Tree connect | Exact published share name and result | Connecting to the share does not prove directory listing or file reading. |
| File operation | Specific path and operation: list, read or write | Success on one object does not describe the whole share. |
Share enumeration is another request to record. It may return names through a different access path from connecting to a named share. Record its result alongside these checkpoints, rather than treating it as a permission test.
Run controlled checks
Replace TARGET_IP, SMB_PORT, SHARE_NAME and the account placeholder with your verified lab values. Select the SMB port already observed in your scoped service discovery; do not assume that every target uses 445.
# On the lab client: inspect the installed version and help
smbclient -V
smbclient --help
# Request share names with an assigned lab account
smbclient -L TARGET_IP -p SMB_PORT -U 'WORKGROUP/labuser'
# Test a known, authorized share with the same identity and port
smbclient '//TARGET_IP/SHARE_NAME' -p SMB_PORT -U 'WORKGROUP/labuser'Let the client prompt for the password. At its interactive prompt, try ls only for the permitted directory, then quit. Keep the connection result separate from the result of ls. Do not put a password in a command, screenshot or exported record.
If the exercise specifically permits a blank-credential check, state the requested credentials explicitly, for example smbclient -L TARGET_IP -p SMB_PORT -U '%' -N. This does not establish the server’s effective identity: guest mapping and anonymous access are different possibilities. -N suppresses the password prompt; it is not proof of an anonymous session.
Use an operation matrix, not an “accessible” label
| Observation | Supported statement | Still unknown |
|---|---|---|
| A share name was returned | This identity could obtain that name in this request. | Connection, listing, read and write permissions |
| Share connection succeeded | Tree connect succeeded for this session. | Permissions on individual directories and files |
| Directory listing succeeded | This directory could be listed. | Reading each listed file or modifying anything |
| A permitted sample file was read | This file could be read at this time. | Other files and write access |
Leave untested operations marked “Not checked.” Do not create or delete a file merely to complete a checklist. A lab can deliberately stop after enumeration or a read-only task.
Choose the next check from the error
For a timeout, revisit the address, network and selected port. For negotiation failure, use the scoped legacy negotiation guide. For session rejection, check the assigned identity and account policy. For tree-connect failure, check the published share name and share connection stage. When names are returned but files cannot be listed, use the listing-versus-access comparison. Preserve the exact error line before changing anything.
Build an SMB operation record
Record what happened for one target and one identity. An empty field exports as “Not checked”; entering text does not verify access. Keep passwords and private file contents out of this record. Entries stay in this page until you leave or reload.
No record generated.
Reference and related workflow
Check command behavior against the installed help and the Samba smbclient manual. For a broader wrapper tool, see the enum4linux practical guide; its output still needs the same operation-by-operation interpretation.