Enumerating SMB Shares Using smbclient
Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?
Quick Answer
The correct command is smbclient -L //<IP> -N, which a penetration tester uses to enumerate SMB shares on a target Windows machine from a Linux system. This works because the -L flag instructs smbclient to list all available SMB shares on the remote server, while -N suppresses the password prompt for a null session, allowing anonymous access to gather share names, including hidden administrative shares like ADMIN$ or IPC$. On the Certified Ethical Hacker CEH exam, this question tests your understanding of SMB enumeration as a critical reconnaissance phase; a common trap is confusing smbclient -L with smbclient //<IP>/share, which connects to a specific share rather than listing them. Remember the memory tip: “List with L, connect with nothing” — the -L flag is your go-to for enumeration, not connection.
⚠ Common exam trap
Watch out — candidates often confuse `nbtstat` (a Windows-only command) with a Linux tool, or assume `ldapsearch` or `snmpwalk` can enumerate SMB shares because they are common enumeration commands, but they operate on entirely different protocols and services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
smbclient -L //<IP> -N
The `smbclient -L //<IP> -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ldapsearch -x -h <IP>
Why it's wrong here
ldapsearch is for LDAP.
- ✓
smbclient -L //<IP> -N
Why this is correct
-L lists shares, -N uses null session.
- ✗
snmpwalk -v2c -c public <IP>
Why it's wrong here
snmpwalk is for SNMP.
- ✗
nbtstat -A <IP>
Why it's wrong here
nbtstat is for NetBIOS, not SMB shares.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are common tools used for SMB enumeration? (Select 2)
easy- A.ldapsearch
- B.snmpwalk
- ✓ C.enum4linux
- D.nbtstat
- ✓ E.smbclient
Why C: enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.