Plunder
TL;DR → Download Plunder
Plunder is an SMB scanning / spidering tool that allows you to efficiently collect information from SMB shares. I originally wrote Plunder in 2010 because I got tired of manually looking through shares, and couldn't abide the limitations of smbclient's recursive features. Plunder implements some business logic (primarily, limiting recursion depth) so that it scans efficiently.
Plunder also has a few other key features:
- Support for pass-the-hash
- Support for download / mirroring
- Process input file listing smb://.../ URLs
- Enumerate accessible shares, etc.
- Implemented for the JVM, so works anywhere you have Java
Update: 2016-08-01
I have updated the download link above for version 1.7 of Plunder. This version merges in support for a configuration file. You can use the '-c' flag to write the default config file out to your ~/.plunder. This is a standard INI file that configures what extensions, names, size criteria, etc., will be used by Plunder during its scans. With this feature, you can now customize what each of the plugins is looking for to better match your testing scenario.
NOTE: since Plunder is 6 years old at this point, I've been limping it along to match my process in casing SMB file shares. I have a new Plunder version 2.x coming soon! Plunder 2.x is more focused on better scanning logic for huge environments (think tens of millions of accessible files in shares), managing and comparing rights between different sets of credentials, and better user interface for long-running scans. It should be out in the next few months (as of writing date 2016-05-22)
Follow me in Twitter (@Josh5tone) for the impeding announcement of the new plunder!