io.github.daedalus/mcp-smbmap

Connect to an SMB host. Args: host: IP or FQDN of target host username: Username for authentication (optional, null session if omitted) password: Password or NTLM hash (format: LMHASH:NTHASH) domain: Domain name (default: WORKGROUP) port: SMB port (default: 445) kerberos: Use Kerberos authentication dc_ip: Domain controller IP or hostname Returns: Connection status Example: >>> connect("192.168.1.100", "admin", "password123") {"success": true, "message": "Connected to 192.168.1.100"}

List all shares on the target host. Args: host: IP or FQDN of target host exclude: List of shares to exclude (default: ['IPC$']) Returns: List of shares with permissions and comments Example: >>> list_shares("192.168.1.100") [{"share": "C$", "permissions": "READ, WRITE", "comment": "Default share"}, ...]

List all drives on the target host. Args: host: IP or FQDN of target host Returns: Dictionary with local and network drives Example: >>> list_drives("192.168.1.100") {"local": [{"share": "C$", "type": "drive"}], "network": []}

List contents of a share path. Args: host: IP or FQDN of target host share: Share name (e.g., 'C$') path: Path to list (default: root '/') depth: Max depth for recursive listing (default: 1) dir_only: List only directories (default: False) pattern: Regex pattern for file name matching Returns: List of files/directories with metadata Example: >>> list_path("192.168.1.100", "C$", "/Users") [{"type": "dir", "name": "Administrator", ...}]

Get OS version of the remote host. Args: host: IP or FQDN of target host Returns: OS version, name, and domain Example: >>> get_version("192.168.1.100") {"Version": "Windows 10.0 Build 19041", "Name": "DESKTOP-ABC123", "Domain": "WORKGROUP"}

Check if host has SMB signing disabled, enabled, or required. Args: host: IP or FQDN of target host Returns: Signing status Example: >>> check_signing("192.168.1.100") {"Host": "192.168.1.100", "signing_status": "signing disabled"}

Execute a command on the remote host. Args: host: IP or FQDN of target host command: Command to execute mode: Execution method - 'wmi' or 'psexec' (default: wmi) share: Share to use for execution (default: C$) Returns: Command output Example: >>> exec_command("192.168.1.100", "ipconfig /all") {"output": "Windows IP Configuration..."}

Download a file from the remote system. Args: host: IP or FQDN of target host path: Remote file path (e.g., 'C$\temp\passwords.txt') Returns: File content as base64 or error Example: >>> download_file("192.168.1.100", "C$\temp\test.txt") {"content": "file content here", "path": "C$\temp\test.txt"}

Upload a file to the remote system. Args: host: IP or FQDN of target host src: Local source file path dst: Destination path on remote (e.g., 'C$\temp\payload.exe') Returns: Success/failure status Example: >>> upload_file("192.168.1.100", "/tmp/payload.exe", "C$\temp\payload.exe") {"success": true, "path": "C$\temp\payload.exe"}

Delete a remote file. Args: host: IP or FQDN of target host path: Remote file path to delete Returns: Success/failure status Example: >>> delete_file("192.168.1.100", "C$\temp\msf.exe") {"success": true, "path": "C$\temp\msf.exe"}

Check if the current user has admin rights on the host. Args: host: IP or FQDN of target host Returns: Admin status Example: >>> check_admin("192.168.1.100") {"is_admin": true, "host": "192.168.1.100"}

Disconnect from an SMB host. Args: host: IP or FQDN of target host Returns: Disconnection status Example: >>> disconnect("192.168.1.100") {"success": true}