Skip to main content

SMB Enumeration

SMB vs NetBIOS​

  • NetBIOS (ports 137, 138, 139) — allows computers on a local network to communicate. Legacy protocol, largely deprecated.
  • SMB (port 445) — file sharing, printer sharing, access to network resources.

Earlier Windows versions used NetBIOS to transport SMB traffic. Modern Windows (2000+) uses SMB directly over TCP/IP on port 445 without relying on NetBIOS.

Nmap Scripts​

OS discovery:

nmap -v -p 139,445 --script smb-os-discovery $TARGET

Enumerate shares:

nmap --script smb-enum-shares.nse -p 445 $TARGET

Enumerate users:

nmap --script smb-enum-users.nse -p 445 $TARGET

NetBIOS info:

nmap --script nbstat.nse $TARGET

Check SMB signing (identifies relay targets) and protocol dialects:

nmap -p 445 --script smb2-security-mode,smb2-capabilities $TARGET

Check for critical SMB vulns (EternalBlue / MS17-010):

nmap -p 445 --script smb-vuln-ms17-010 $TARGET
tip

message_signing: disabled/enabled but not required means the host is a candidate for SMB relay attacks — exactly the condition to flag both when attacking and when hunting for it in the SIEM.

nbtscan​

nbtscan $SUBNET

enum4linux​

Comprehensive SMB enumeration:

sudo enum4linux -r $TARGET

Cheat sheet: https://highon.coffee/blog/enum4linux-cheat-sheet/

Updated version:

sudo enum4linux-ng $TARGET

rpcclient​

Bind over the MS-RPC interface (works with a null session on older/misconfigured hosts):

rpcclient -U "" -N $TARGET

Useful commands once connected:

srvinfo                 # server OS / version
enumdomusers            # list domain users
enumdomgroups           # list groups
querydispinfo           # users with descriptions (look for passwords)
lookupnames administrator   # resolve a name to its RID/SID

smbclient​

List shares (authenticated):

smbclient -L //$TARGET -U $USER

Test anonymous access:

smbclient -L //$TARGET -N

Connect to a share:

smbclient //$TARGET/sharename -U $USER

Once connected, download files:

get filename.txt           # download a single file
prompt off                 # disable per-file confirmation
recurse on                 # descend into subdirectories
mget *                     # download everything in scope

smbmap​

smbmap -H $TARGET
smbmap -H $TARGET -u $USER -p $PASSWORD

Recursively list and search share contents, then pull a file:

smbmap -H $TARGET -u $USER -p $PASSWORD -R              # recurse all shares
smbmap -H $TARGET -u $USER -p $PASSWORD -R sharename --depth 5
smbmap -H $TARGET -u $USER -p $PASSWORD --download 'sharename/path/file.txt'

NetExec (nxc)​

Enumerate shares with credentials:

nxc smb $TARGET -u $USER -p $PASSWORD --shares

Test null session:

nxc smb $TARGET -u '' -p ''

Enumerate users via RID cycling (works over a null/guest session on many hosts):

nxc smb $TARGET -u '' -p '' --rid-brute

Spider shares for interesting files:

nxc smb $TARGET -u $USER -p $PASSWORD -M spider_plus
tip

Even without a password, smbclient -L can sometimes reveal share names and comments which provide useful intelligence about the target.