1. INTRODUCTION
enum4linux is a Linux tool for enumerating information from Windows/Samba systems.
Useful for:
2. BASIC ENUMERATION
Simple scan:
enum4linux
Example:
enum4linux 10.10.10.5
3. FULL VERBOSE ENUMERATION
Most used command:
enum4linux -a
The -a flag performs:
- User enumeration
- Group enumeration
- Share listing
- Password policy discovery
- RID cycling
- OS info
4. NULL SESSION ENUMERATION
Try anonymous login first:
enum4linux -a -u "" -p ""
Useful for:
- Guest or anonymous SMB access
- Legacy Windows systems
5. USER ENUMERATION
List users:
enum4linux -U
RID cycling:
enum4linux -r -u "" -p ""
6. GROUP ENUMERATION
List groups:
enum4linux -G
7. SHARE ENUMERATION
List SMB shares:
enum4linux -S
8. PASSWORD POLICY
Check password rules:
enum4linux -P
Information discovered:
- Minimum password length 18]
- Password history length
- Account lockout policy
- Max password age
9. OS & DOMAIN INFO
Check OS version:
enum4linux -o
Get domain/workgroup:
enum4linux -n
10. SPECIFIC USER INFO
Query specific user:
enum4linux -u -i
11. COMBINING WITH SMBMAP / SMBCLIENT
Example workflow:
1. Enumerate with enum4linux:
enum4linux -a 10.10.10.5
2. Check shares with smbmap:
smbmap -H 10.10.10.5
3. Connect with smbclient:
smbclient //10.10.10.5/SHARE -U username
12. CTF / PENTEST WORKFLOW
1. Null session test:
enum4linux -a -u "" -p "" 10.10.10.5
2. Check users:
enum4linux -U 10.10.10.5
3. Check shares:
enum4linux -S 10.10.10.5
4. Check password policy:
enum4linux -P 10.10.10.5
5. Run RID cycling for hidden users:
enum4linux -r -u "" -p "" 10.10.10.5
6. Use SMBMap for deeper enumeration: 19]
smbmap -H 10.10.10.5
7. Try brute-forcing with Hydra (only if authorized):
hydra -l user -P rockyou.txt smb://10.10.10.5
← Back to tutorial