Enum4linux: Everything SMB Will Tell You Without a Password

Series: The Community's Red Team

Post: 05 of 17

Tags: enum4linux, smb, samba, enumeration, null session, tools

Read time: ~10 min

Prerequisites: Post 01 — Methodology Overview, Post 02 — Nmap

If Nmap shows ports 139 or 445 open, you have an SMB service. And SMB — Server Message Block, Microsoft's file-sharing protocol — has a long history of being more talkative than it should be without any credentials at all.

Enum4linux automates the conversation. Point it at an SMB service, run one command, and it comes back with usernames, group memberships, file shares, password policy, and operating system information — all before you've supplied a single credential. That sounds like it shouldn't be possible. On modern, properly hardened systems it often isn't. But on real networks in the real world, legacy configurations, default settings, and decades of accumulated technical debt mean null session enumeration works more often than it has any right to.

This post covers Enum4linux from the ground up — what it does, how to read the output, and how to use what you find.

What SMB Is and Why It Matters

SMB is the protocol Windows uses for file sharing, printer sharing, and inter-process communication. It's on almost every Windows machine and many Linux servers running Samba (the open-source SMB implementation).

From an attacker's perspective, SMB is interesting for three reasons:

It exposes information by design. SMB was built for a trusted internal network. Parts of it were designed to share information about the environment — hostnames, domain names, user lists — so other machines could find resources. That design decision made sense in 1980s office networks. It doesn't age well.

It's a lateral movement channel. Once you have credentials, SMB lets you connect to file shares, execute code remotely (via psexec, wmiexec), dump password hashes, and move through a network. It's the primary lateral movement protocol in Windows environments.

It has a history of critical vulnerabilities. EternalBlue (MS17-010), the NSA exploit that powered WannaCry, ran over SMB. So did several other high-impact exploits. Unpatched SMB services on internal networks are a recurring finding in real penetration tests.

Enum4linux handles the first part: squeezing as much information as possible out of SMB before you have any credentials.

Running the Full Enumeration

One flag covers everything:

enum4linux -a <target>

-a runs all checks. That's what you want on a first pass. The tool will go through every section and report what it finds. On a verbose target this produces several hundred lines of output — save it to a file:

enum4linux -a <target> | tee enum4linux_output.txt

tee both displays output in the terminal and saves it to the file simultaneously. You want both — watching it live tells you when something interesting appears, and the saved file lets you search through it later.

What Each Section Gives You

Enum4linux output is broken into sections. Here's what to look for in each one.

OS Information

[*] Enumerating OS information...
[+] Got OS info for <target> from smbclient: 
    Domain=[WORKGROUP] OS=[Windows 10.0 Build 19041] Server=[...]

The OS version narrows your attack surface. Windows 10 Build 19041 maps to a specific release — look up what vulnerabilities affect that build. Whether it's a domain member or workgroup changes your attack path entirely.

Users

[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
user:[tony] rid:[1000]
user:[administrator] rid:[500]
user:[svc_backup] rid:[1001]

This is a username list without needing any credentials. Every username here is a target for:

• Password spraying (test one password against all users)

• Targeted brute force (run a full wordlist against a specific interesting account)

• Further enumeration (service accounts like svc_backup often have weak passwords)

Save the username list immediately. It feeds everything that comes after.

enum4linux -a <target> | grep "user:" | cut -d'[' -f2 | cut -d']' -f1 > users.txt

Shares

[+] Attempting to map shares on <target>
//target/IPC$    Mapping: OK Listing: OK
//target/Users   Mapping: OK Listing: OK
//target/Backup  Mapping: OK Listing: OK
//target/C$      Mapping: DENIED

Shares marked Mapping: OK are accessible without credentials. Connect to them immediately:

smbclient //<target>/Backup -N

The -N flag means no password. Inside, use ls to list files, get <filename> to download them, and mget * to download everything.

What to look for in accessible shares:

• Config files with database passwords or API keys

• Scripts with hardcoded credentials

• SSH private keys (id_rsa)

• IT documentation with account information

• Database dumps

The C$ being denied is normal — that's the administrative share that requires admin credentials. The presence of non-default shares (Backup, Users) is where the value is.

Password Policy

[+] Retieving password policy for <target>
Password Complexity: Disabled
Minimum password age: 0 days
Maximum password age: 41 days
Minimum password length: 5
Password history length: None
Lockout threshold: None

Read this section before you start any brute force or password spraying. Specifically:

Lockout threshold. If this says None or 0, there's no account lockout — you can brute force without locking anyone out. If there's a threshold (common values: 3, 5, 10), you need to stay under it with password spraying or you'll lock out accounts and alert the defenders.

Minimum password length of 5. Tells you the minimum complexity users could have set. Short wordlists become more relevant.

Password complexity disabled. Means users can have simple passwords. Password1, Welcome1, admin123 are all viable.

This section is not optional. A careless password spray that locks out 200 domain accounts is a very bad day for everyone. Check this first.

Groups

[+] Getting builtin group memberships:
Group 'Administrators' (RID: 544) has member: <target>\administrator
Group 'Administrators' (RID: 544) has member: <target>\IT_Admin

Group membership shows who has elevated privileges. A user in the Administrators group is a high-value target for credential attacks. Domain groups reveal the organizational structure — IT_Admin is more interesting than Marketing.

Domain and Workgroup

[+] Got domain/workgroup name: INLANEFREIGHT

Domain name is critical for Active Directory attacks. It goes into every subsequent command — Kerberoasting, password spraying, LDAP queries, everything. Note it immediately.

Null Sessions: Why This Works

A null session is an unauthenticated connection to an SMB service — you connect with an empty username and empty password. It sounds like it shouldn't work. On modern Windows systems with default settings, it largely doesn't for the sensitive parts. But:

• Older Windows systems (Server 2003, Windows XP era) allowed extensive null session enumeration

• Many Linux/Samba servers still have configurations that permit it

• Some services within a network still run legacy configurations for compatibility

• The IPC$ share (Inter-Process Communication) is accessible via null session on most systems and enables the RPC calls that Enum4linux makes

Enum4linux uses null sessions by default. When null sessions are restricted, some sections will fail and others may still succeed depending on specific configuration. Don't assume failure in one section means the whole target is locked down — check each section of the output independently.

Enum4linux-ng: The Modern Alternative

The original Enum4linux is a wrapper around several Samba tools (smbclient, rpcclient, net). It works well but can be noisy about errors and has some quirks. Enum4linux-ng is a Python rewrite that's cleaner and more reliable:

# Install
pip3 install enum4linux-ng --break-system-packages

# Run all checks
enum4linux-ng -A <target>

# Output to file
enum4linux-ng -A <target> -oY output.yaml

The output is cleaner and it handles more edge cases. If the original enum4linux is throwing errors on a target, try enum4linux-ng.

Authenticated Enumeration: When You Have Credentials

Once you have credentials from any source — found in a share, cracked from a hash, guessed from the password policy — go back to SMB with those credentials and enumerate further:

# List shares with credentials
smbclient -L //<target> -U <username>%<password>

# Connect to a specific share
smbclient //<target>/<share> -U <username>%<password>

# CrackMapExec for authenticated enumeration
crackmapexec smb <target> -u <username> -p <password> --shares
crackmapexec smb <target> -u <username> -p <password> --users
crackmapexec smb <target> -u <username> -p <password> --groups

Authenticated access to shares opens up significantly more content. The difference between what's accessible anonymously and what's accessible with even a low-privilege account is usually substantial.

Building the Attack Chain from Enum4linux Output

This is what you do with what you found:

Got a username list? → Feed it to Hydra (Post 07) for targeted brute force, or use it for password spraying via CrackMapExec (Post 06).

Found accessible shares? → Connect with smbclient, download everything, search for credentials and keys.

Got the password policy? → If no lockout, brute force is safe. If there's a lockout threshold, switch to password spraying with a single common password.

Got the domain name? → You're in an Active Directory environment. This domain name goes into every AD attack that follows — Kerberoasting, LDAP enumeration, Bloodhound collection (Post 17).

Found an OS version? → Look up vulnerabilities. Windows Server 2016 without patches is a different attack surface than a fully patched Windows 11 workstation.

Common Flags Reference

Flag	What it does
-a	All enumeration (recommended default)
-U	Enumerate users only
-S	Enumerate shares only
-G	Enumerate groups only
-P	Get password policy only
-o	Get OS information only
-u <user>	Use specific username (default: empty)
-p <pass>	Use specific password (default: empty)
-w <domain>	Specify workgroup/domain
-n	Do RID cycling to enumerate users

Quick Reference

# Full enumeration — save to file
enum4linux -a <target> | tee enum4linux.txt

# Extract usernames from output
enum4linux -a <target> | grep "user:" | cut -d'[' -f2 | cut -d']' -f1 > users.txt

# Users only
enum4linux -U <target>

# Shares only
enum4linux -S <target>

# Password policy only (check before spraying)
enum4linux -P <target>

# Enum4linux-ng (modern alternative)
enum4linux-ng -A <target>
enum4linux-ng -A <target> -oY output.yaml

# Manual null session with smbclient
smbclient -L //<target> -N

# Connect to a share anonymously
smbclient //<target>/<share> -N

# Download everything from a share
smbclient //<target>/<share> -N -c "recurse ON; prompt OFF; mget *"

# Authenticated share list
smbclient -L //<target> -U <user>%<pass>

What's Next

With a username list, a password policy, and any accessible shares enumerated, you're ready to move. The most natural next step from Enum4linux is CrackMapExec (Post 06) — it takes the username list and password policy you just collected and turns them into a systematic credential attack across every Windows service at once.

If you're seeing domain indicators (domain name, Kerberos ports from Nmap, DC hostnames), Post 17 (Bloodhound) eventually maps the full AD attack path. That comes after you have credentials.

MeshForge — Training the Community's Red Team

They count on your ignorance. The exploit only works on the uninformed.