SMB/Samba enumeration — shares, users, groups & null sessions
enum4linux (and the faster enum4linux-ng) wrap Samba tools to enumerate Windows/Samba hosts over SMB — users, groups, shares, password policy, and OS info via RPC/SMB. smbclient is the interactive FTP-style client for browsing and transferring files on SMB shares. For authorized testing only.
enum4linux -a 10.10.10.10 # "all" — the usual first move
enum4linux -a -u 'guest' -p '' 10.10.10.10
enum4linux -U 10.10.10.10 # users only
enum4linux -S 10.10.10.10 # shares only
enum4linux -G 10.10.10.10 # groups only
enum4linux -P 10.10.10.10 # password policy
enum4linux -o 10.10.10.10 # OS information
enum4linux -r 10.10.10.10 # RID cycle to enumerate users
| Flag | Enumerates |
|---|---|
-a |
Do everything (-U -S -G -P -o -r -n -i) |
-U |
Userlist |
-S |
Share list |
-G |
Group + member list |
-P |
Password policy |
-o |
OS info |
-r |
RID cycling (find users when RestrictAnonymous blocks lists) |
-n |
nmblookup (NetBIOS over TCP/IP) |
-u / -p |
Username / password to authenticate with |
enum4linux-ng -A 10.10.10.10 # all, auto-detect
enum4linux-ng -A -u user -p pass 10.10.10.10
enum4linux-ng -A 10.10.10.10 -oJ out # write out.json
enum4linux-ng -R 10.10.10.10 # RID cycling
enum4linux-ng -C 10.10.10.10 # enumerate via known SIDs
-A is the -ng equivalent of classic -a. Output is structured (YAML/JSON) and the tool is much faster.
smbclient -L //10.10.10.10 -N # null session, list shares
smbclient -L //10.10.10.10 -U 'user%password' # authenticated list
smbclient -L //10.10.10.10 -U 'DOMAIN\user' # domain user (prompts for pass)
smbclient -L //10.10.10.10 -U 'guest%' # guest, empty password
| Flag | Meaning |
|---|---|
-L //host |
List available shares |
-N |
No password (null/anonymous session) |
-U 'user%pass' |
Credentials inline (DOMAIN\user%pass for domain) |
--pw-nt-hash |
Treat the -U password as an NT hash (pass-the-hash) |
-c '<cmds>' |
Run smbclient commands non-interactively |
-m SMB2 / SMB3 |
Force a protocol dialect |
-k |
Use Kerberos (from KRB5CCNAME) |
smbclient //10.10.10.10/SHARE -N # anonymous
smbclient //10.10.10.10/SHARE -U 'user%password'
smbclient //10.10.10.10/SHARE -U user --pw-nt-hash <NThash> # pass-the-hash
Inside the smb: \> prompt:
ls # list current directory
cd subfolder
get secret.txt # download a file
put payload.exe # upload a file
mget * # download multiple
prompt off # disable per-file confirm before mget/mput
recurse on # recurse for mget
mask "" # clear the filter so recurse grabs everything
more readme.txt # view a file without downloading
!ls # run a local shell command
exit
# Single command
smbclient //10.10.10.10/SHARE -N -c 'ls'
smbclient //10.10.10.10/SHARE -N -c 'get flag.txt /tmp/flag.txt'
# Recursively download an entire share
smbclient //10.10.10.10/SHARE -N -c 'recurse ON; prompt OFF; mget *'
# Upload a file
smbclient //10.10.10.10/SHARE -U 'user%pass' -c 'put shell.aspx'
sudo mkdir -p /mnt/share
sudo mount -t cifs //10.10.10.10/SHARE /mnt/share -o username=user,password=pass
sudo mount -t cifs //10.10.10.10/SHARE /mnt/share -o username=guest,password=,vers=3.0
# anonymous:
sudo mount -t cifs //10.10.10.10/SHARE /mnt/share -o guest,vers=3.0
# Other SMB enumerators worth running alongside
smbmap -H 10.10.10.10 # share perms at a glance
smbmap -H 10.10.10.10 -u user -p pass -R SHARE # recurse listing with perms
rpcclient -U '' -N 10.10.10.10 # null RPC session
# inside rpcclient: enumdomusers querydispinfo lsaenumsid enumdomgroups
nmap --script smb-enum-shares,smb-os-discovery -p445 10.10.10.10
-N / -U ''): misconfigured hosts leak users, shares, and the password policy with no creds.READ/WRITE access on a share is the prize — note it from smbmap and read configs, scripts, and backups for creds.--pw-nt-hash on smbclient and --pw-nt-hash workflows let you browse shares straight from a stolen NT hash.-a output.-m SMB2/vers=3.0 when old hosts refuse the default negotiation.Authorized testing only. Practice on the AYSEC pro-labs. See also NetExec / CrackMapExec and Impacket.