SMB enumeration

SMB, or Server Message Block, is a network protocol commonly used by Windows systems for file sharing, printer sharing and access to network resources. SMB can also expose information about users, shares, domains and system configuration.

Modern SMB normally uses TCP port 445 directly. Older SMB deployments may operate through NetBIOS over TCP port 139.

NetBIOS provides legacy naming and session services used by older Windows networking environments. SMB over NetBIOS is commonly associated with TCP 139 and UDP ports 137 and 138.

Start by determining whether SMB is available, identifying the SMB implementation and collecting basic host information.

SMB has evolved through multiple versions. SMBv1 is legacy and insecure, while SMBv2 and SMBv3 provide major protocol and security improvements. Protocol-version enumeration is useful when assessing a host.

Nmap can report SMB security characteristics such as whether message signing is enabled or required.

Shares are one of the most important pieces of information exposed by SMB. A share may contain documents, configuration files, scripts, backups or other useful data.

Once a share is identified, smbclient can provide an interactive session similar to an FTP client.

Inside smbclient, enumerate directories and files and download relevant content for offline analysis.

A NULL session is an unauthenticated SMB or RPC session created without supplying normal user credentials. Older or misconfigured Windows and Samba systems may expose shares, users or other information through NULL sessions.

Guest access is different from a classic NULL session. A server may map unauthenticated or invalid users to a guest account and grant that account limited access to specific shares.

rpcclient can interact with Microsoft RPC services exposed through SMB and may enumerate users, groups and domain information when permissions allow it.

smbmap provides a quick overview of available shares and the permissions associated with them.

During SMB enumeration, distinguish between shares that are inaccessible, readable or writable. Writable shares deserve additional attention because files can potentially be created or modified.

enum4linux automates several SMB, NetBIOS and RPC enumeration techniques and can gather users, shares, groups and other information from compatible systems.

enum4linux-ng is a newer implementation that provides structured SMB and RPC enumeration and is useful when available in the environment.

nmblookup queries NetBIOS names and can help identify legacy Windows or Samba naming information.

NetExec, invoked as nxc, can enumerate SMB hosts, validate credentials, list shares and perform other SMB-related tasks. CrackMapExec is the historical tool from which this workflow evolved.

When the account has sufficient permissions, NetExec can request additional account information from an SMB target.

Share spidering recursively searches SMB shares for files and directories. It can help identify configuration files, scripts, backups and credential-related material in large shares.

Metasploit provides multiple auxiliary scanners for SMB service and host enumeration.

The SMB share enumeration module can identify shares visible to the supplied authentication context.

Metasploit also provides modules for enumerating SMB users when the target configuration allows it.

The SMB login scanner validates SMB username and password combinations during an authorised credential assessment.

SMB hosts may belong to a standalone workgroup or an Active Directory domain. Identifying this context helps interpret usernames, authentication formats and accessible resources.

SMB can also support remote administrative techniques such as PsExec through administrative shares and service creation. That workflow is better treated separately as remote execution and lateral movement rather than basic SMB enumeration.

Identify SMB versions and host information, test anonymous or guest access, enumerate shares and permissions, inspect accessible files, enumerate users and groups through SMB or RPC, then validate known credentials when authorised.

These are the SMB commands worth remembering for service enumeration.