第一：依靠135端口，用wmi。像下邊的腳本是得到共享目錄ttt的物理目錄。

第二、依靠445端口，靠smb。bt5下的 nmap

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-14 15:29 CST
Nmap scan report for 192.168.1.108
Host is up (0.00013s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 00:0C:29:B3:F6:79 (VMware)
Host script results:
| smb-enum-shares:
| ADMIN$
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Remote Admin
| Users: 0, Max: <unlimited>
| Path: C:\WINDOWS
| Anonymous access: <none>
| Current user ('administrator') access: READ/WRITE
| C$
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Default share
| Users: 0, Max: <unlimited>
| Path: C:\
| Anonymous access: <none>
| Current user ('administrator') access: READ/WRITE
| IPC$
| Type: STYPE_IPC_HIDDEN
| Comment: Remote IPC
| Users: 1, Max: <unlimited>
| Path:
| Anonymous access: READ <not a file share>
| Current user ('administrator') access: READ <not a file share>
| NETLOGON
| Type: STYPE_DISKTREE
| Comment: Logon server share
| Users: 0, Max: <unlimited>
| Path: C:\WINDOWS\SYSVOL\sysvol\haiyangtop.com\SCRIPTS
| Anonymous access: <none>
| Current user ('administrator') access: READ/WRITE
| SYSVOL
| Type: STYPE_DISKTREE
| Comment: Logon server share
| Users: 0, Max: <unlimited>
| Path: C:\WINDOWS\SYSVOL\sysvol
| Anonymous access: <none>
| Current user ('administrator') access: READ/WRITE
| ttt
| Type: STYPE_DISKTREE
| Comment:
| Users: 0, Max: <unlimited>
| Path: c:\sharettt
| Anonymous access: <none>
|_ Current user ('administrator') access: READ
Nmap done: 1 IP address (1 host up) scanned in 0.56 seconds
root@bt:~#