Disclaimer: Please only use these commands if you have permission to use them on the IP address of your choice.
Smbclient is a CLI-tool to access drive shares. For this to work, usually the port 445 needs to be open. This can be checked with Nmap. If port 445 is open, you can list shares with the following command. Please exchange ip witht the machines IP address!
smbclient -L ip
If this does not work, you can try to add default Windows credentials:
smbclient -L ip -U Administrator password: hit enter
If the request is successful, the output may look like this:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC WorkShares Disk
To open WorkShares, run
Then you can use these commands
ls // list content cd // + .. or a directory name to move around get filename // to download a file ctrl + c // close the share