第一：依靠135端口，用wmi。像下边的脚本是得到共享目录ttt的物理目录。

复制代码 代码如下:

strPath ="192.168.1.55ttt"

strPath = Replace(strPath, "", "")

arrPath = Split(strPath, "")

strComputer = arrPath(0)

strShare = arrPath(1)

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")

Set objWMIService =objSWbemLocator.ConnectServer(strComputer, "rootCIMV2", "admin", "123")

Set colItems = objWMIService.ExecQuery _

("Select * From Win32_Share Where Name = '" & strShare & "'")

For Each objItem in colItems

Wscript.Echo objItem.Path

Next

/*********************************微软的脚本有问题，只能得到本机***********************************************/

strPath = "atl-fs-01public"

strPath = Replace(strPath, "", "")

arrPath = Split(strPath, "")

strComputer = arrPath(0)

strShare = arrPath(1)

Set objWMIService = GetObject("winmgmts:" & strComputer & "rootcimv2")

Set colItems = objWMIService.ExecQuery _

("Select * From Win32_Share Where Name = '" & strShare & "'")

For Each objItem in colItems

Wscript.Echo objItem.Path

Next

/*********************************微软的脚本有问题，只能得到本机***********************************************/

第二、依靠445端口，靠smb。bt5下的 nmap

复制代码 代码如下:

root@bt:~# nmap --script smb-enum-shares --script-args=smbuser=administrator,smbpass=toor 192.168.1.108 -p445

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-14 15:29 CST

Nmap scan report for 192.168.1.108

Host is up (0.00013s latency).

PORT STATE SERVICE

445/tcp open microsoft-ds

MAC Address: 00:0C:29:B3:F6:79 (VMware)

Host script results:

| smb-enum-shares:

| ADMIN$

| Type: STYPE_DISKTREE_HIDDEN

| Comment: Remote Admin

| Users: 0, Max: <unlimited>

| Path: C:WINDOWS

| Anonymous access: <none>

| Current user ('administrator') access: READ/WRITE

| C$

| Type: STYPE_DISKTREE_HIDDEN

| Comment: Default share

| Users: 0, Max: <unlimited>

| Path: C:

| Anonymous access: <none>

| Current user ('administrator') access: READ/WRITE

| IPC$

| Type: STYPE_IPC_HIDDEN

| Comment: Remote IPC

| Users: 1, Max: <unlimited>

| Path:

| Anonymous access: READ <not a file share>

| Current user ('administrator') access: READ <not a file share>

| NETLOGON

| Type: STYPE_DISKTREE

| Comment: Logon server share

| Users: 0, Max: <unlimited>

| Path: C:WINDOWSSYSVOLsysvolhaiyangtop.comSCRIPTS

| Anonymous access: <none>

| Current user ('administrator') access: READ/WRITE

| SYSVOL

| Type: STYPE_DISKTREE

| Comment: Logon server share

| Users: 0, Max: <unlimited>

| Path: C:WINDOWSSYSVOLsysvol

| Anonymous access: <none>

| Current user ('administrator') access: READ/WRITE

| ttt

| Type: STYPE_DISKTREE

| Comment:

| Users: 0, Max: <unlimited>

| Path: c:sharettt

| Anonymous access: <none>

|_ Current user ('administrator') access: READ

Nmap done: 1 IP address (1 host up) scanned in 0.56 seconds

root@bt:~#