Aqui alguns comandos básicos mas que ajudam muito, e como eu ando com a memória ruim, roubei essa dica já meio pronta de outro blog, achei legal, e to compartilhando!
Testar compartilhamentos abertos/445
Liste os compartilhamentos com smbclient -L 1.2.3.4
root@localhost:~# smbclient -L 1.2.3.4
Enter root’s password:
Anonymous login successful
Domain=[MSHOME] OS=[VxWorks] Server=[NQ 4.32]
Sharename Type Comment
——— —- ——-
IPC$ IPC
MEMORY_CARD Disk FLASH MEMORY PHOTO
Anonymous login successful
Domain=[MSHOME] OS=[VxWorks] Server=[NQ 4.32]
Server Comment
——— ——-
Workgroup Master
——— ——-
Tente se conectar ao compartilhamento
root@localhost:~# smbclient \\\\1.2.3.4\\MEMORY_CARD
Enter root’s password:
Anonymous login successful
Domain=[MSHOME] OS=[VxWorks] Server=[NQ 4.32]
tree connect failed: NT_STATUS_ACCESS_DENIED
Boo
Quando funciona:
root@localhost:~# smbclient \\\\2.3.4.5\\MDMLOAD
Enter root’s password:
Anonymous login successful
Domain=[DEMO] OS=[Unix] Server=[Samba 3.6.23-20.el6]
smb: \> l
. D 0 Wed Nov 4 02:42:15 2015
.. D 0 Mon Oct 12 20:38:40 2015
input.csv A 2024 Mon Nov 2 22:13:18 2015
59400 blocks of size 2097152. 19612 blocks available
enum4linuxajuda quando você tem uma quantidade boa de compartilhamentosou se você quiser fazer algo mais especifico e rápido. -S para verificar compartilhamentos, ou -a para varrer tudo.
root@localhost:~/enum4linux-0.8.9# perl enum4linux.pl -S 3.4.5.6
==========================
| Target Information |
==========================
Target ……….. 3.4.5.6
RID Range …….. 500-550,1000-1050
Username ……… ”
Password ……… ”
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
==========================================
| Share Enumeration on 3.4.5.6 |
==========================================
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.12]
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.12]
Sharename Type Comment
——— —- ——-
www Disk Public Stuff
IPC$ IPC IPC Service (Samba Server Version 4.1.12)
Server Comment
——— ——-
Workgroup Master
——— ——-
[+] Attempting to map shares on 3.4.5.6
//3.4.5.6/www Mapping: OK, Listing: OK
//3.4.5.6/IPC$ Mapping: OK Listing: DENIED
enum4linux complete on Tue Dec 15 22:35:09 2015
root@localhost:~# smbclient \\\\3.4.5.6\\www
Enter root’s password:
Anonymous login successful
Domain=[MYGROUP] OS=[Unix] Server=[Samba 4.1.12]
smb: \> ls
. DR 0 Sat Dec 12 14:23:20 2015
.. D 0 Thu Oct 8 11:53:20 2015
oops D 0 Fri Nov 27 17:38:04 2015
—SNIP—
Quer fazer o download de uma pasta?
root@localhost:~# smbget -R smb://3.4.5.6/www/oops
Username for www at 3.4.5.6 [guest]
Password for www at 3.4.5.6:
Using workgroup WORKGROUP, guest user
smb://3.4.5.6/www/oops/images/defaultpic.gif smb://3.4.5.6/www/oops/images/ad2.jpg
—SNIP—
enum4liux ajuda muito no teste interno, ele tenta enumerar os domain SID, se obtiver sucesso ele faz um brute force do SID para enumerar todos os SIDs/user accounts do dominio.
Mundo Tecnológico 
