Enumerating SMB with enum4linux-ng and smbclient

1. Understanding SMB and the Goal of Enumeration

Before we use the tools, let's understand our target. Server Message Block (SMB) is a network protocol used for providing shared access to files, printers, and other resources. Samba is the standard implementation of the SMB protocol on Linux and Unix systems, allowing them to communicate and share resources with Windows-based machines.

From a penetration tester's perspective, an SMB server is a treasure trove of information. Proper enumeration can reveal:

• Shared folders (shares): Some might be readable or even writable by anyone.
• Usernames: A list of valid users is invaluable for password-guessing attacks.
• System Information: OS version, workgroup/domain names, and network information.
• Password Policies: Details like minimum password length can help refine attacks.

To get a solid overview of these concepts, let's start with a short video.

As the video mentioned, a common weakness is the null session, which allows an anonymous user to connect to the IPC$ (Inter-Process Communication) share and query the system for information. This is often the first thing we test for.

2. Manual Enumeration with smbclient

The smbclient utility is part of the Samba suite and is your go-to tool for manually interacting with SMB shares from the command line. Think of it as an ftp-like client for SMB.

Listing Available Shares

Your first step is almost always to list the shares on the target to see what's available.

The command to list shares on a target is:

smbclient -L //TARGET_IP -N

When you see the list of shares, you're looking for anything that seems out of the ordinary or suggests it might contain sensitive data (e.g., "backups", "HR", "dev_files").

Connecting to a Share

If you find a share that seems accessible (or you have credentials), you can connect to it directly. For an anonymous connection, you might just press Enter at the password prompt.

smbclient //TARGET_IP/share_name -N

Once connected, you'll get an smb: \> prompt where you can use commands like ls, cd, get, and put to navigate the share and transfer files, just like in an FTP session.

3. Automated Enumeration with enum4linux-ng

While smbclient is great for targeted manual checks, we often want to automate the process of gathering as much information as possible. This is where enum4linux-ng shines. It's a modern Python-based rewrite of the classic enum4linux Perl script. It acts as a wrapper, running dozens of different queries to gather a comprehensive report.

As the article mentions, enum4linux-ng automates the discovery of users, shares, OS info, password policies, and more. A great first command to run is the "all" scan:

enum4linux-ng -A TARGET_IP

The -A flag tells the tool to run all enumeration checks. This can be noisy, but it's very thorough.

The output from enum4linux-ng gives you a roadmap for your next steps. Finding a list of users, for example, is the first step toward a password-spraying attack. Discovering a world-readable share might lead you directly to sensitive files.

4. Hands-On Lab: Enumerating SMB on Metasploitable2

Now it's time to apply these techniques in your lab. Ensure your Kali and Metasploitable2 VMs are running and you have the IP address for Metasploitable2.

1. Confirmation Scan

First, let's confirm the SMB service is running, just as we did in the last lesson.

nmap -p 139,445 -sV <metasploitable_IP>

You should see that the target is running Samba. Note the version number Nmap finds.

2. Manual Share Listing

Use smbclient to list the shares available on Metasploitable2.

smbclient -L //<metasploitable_IP> -N

Look at the output. Do you see any shares that look interesting? You should see a tmp share, which is often configured with weak permissions.

3. Explore a Share

Let's try to connect to the tmp share anonymously.

smbclient //<metasploitable_IP>/tmp -N

You should be dropped into an smb: \> prompt. Use the ls command. Do you see any files? This confirms you have read access. You can exit by typing exit.

4. Full Automated Enumeration

Now, unleash enum4linux-ng to get the full picture. We will use -A for all checks and pipe the output to the tee command, which both displays it on the screen and saves it to a file for later analysis.

enum4linux-ng -A <metasploitable_IP> | tee metasploitable_smb.txt

This command will take a minute or two to run. Once it's done, review the output on your screen or by opening the file (cat metasploitable_smb.txt). Find the answers to these questions:

• What Samba version is reported? Does it match what Nmap found?
• Under the "Users" section, what are three of the usernames that were discovered?
• Under "Share R/W", which shares are listed as having READ and/or WRITE access for anonymous users?
• What is the "minimum password length" reported under the password policy section?

This exercise simulates a real-world workflow: you've gone from identifying a service with Nmap to deeply enumerating it to find actionable intelligence.

Conclusion

You've now added SMB enumeration to your skillset, a critical part of the reconnaissance phase. You understand that identifying an open SMB port is just an invitation to dig deeper.

Key Takeaways:

• SMB/Samba is a common protocol for file sharing and a frequent target for attackers due to misconfigurations.
• smbclient is your manual tool for listing and interacting with individual SMB shares. The smbclient -L //TARGET -N command is your starting point for listing shares via a null session.
• enum4linux-ng is a powerful automated enumeration tool that gathers users, groups, shares, policies, and OS information. The enum4linux-ng -A <IP> command provides a comprehensive initial report.
• The information you gather—especially user lists and accessible shares—directly informs the next steps in a penetration test.

Next Lesson Preview:

SMB is just one of many services you'll need to enumerate. In the next lesson, we'll return to Nmap and explore its powerful Nmap Scripting Engine (NSE). You'll learn how to use pre-built scripts to enumerate and check for misconfigurations in other common network services like NFS and SMTP.