SMB Enumeration: Mapping Shares, Users and Sessions

SMB enumeration is usually the first real progress you make on an internal network, often before you hold a single valid credential. The Server Message Block service sits on almost every Windows host and plenty of Linux boxes running Samba, and it is chatty: given the right question it will hand back share names, user lists, group memberships, the password policy, and who is logged on right now. This guide walks the whole process end to end, from fingerprinting the service on its two ports to pulling a user list out of a box that was supposed to be locked down, using the tools you already have on Kali.

Read it top to bottom once to build the model, then keep it open as a checklist. Every command here is aimed at a lab you own or a host you are explicitly authorized to test.

01What SMB is, and where SMB enumeration begins

Server Message Block, or SMB, is the protocol Windows uses for file and printer sharing, and SMB enumeration begins by confirming the service is listening and learning which dialect it speaks. SMB exposes two TCP ports and you will see one or both open on a target. Port 445 is modern SMB running directly over TCP. Port 139 is the older NetBIOS Session Service, which carries SMB inside a NetBIOS session and usually travels with UDP 137 and 138 for name and datagram service. If 445 is open you talk to it directly; if only 139 is open you go through NetBIOS, and the NetBIOS name of the host becomes useful on its own.

The dialect matters because it tells you the age of the host and which hardening is likely missing. SMBv1, also called CIFS, is the legacy version tied to old exploits and should never be on a modern network. SMBv2 shipped with Vista and Server 2008, SMBv3 with Windows 8 and Server 2012, and SMB 3.1.1 is what current Windows negotiates. A host still offering SMBv1 is a finding by itself.

# 0xpriv.dev/network
# quick sweep: are 139 and 445 open, and which dialect answers?
nmap -p139,445 -sV --script smb-protocols,smb2-security-mode 10.10.10.5

$ nmap -p139,445 -sV --script smb-protocols 10.10.10.5
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
| smb-protocols:
|   dialects:
|     NT LM 0.12 (SMBv1 [dangerous])
|     2:0:2
|     2:1:0
|     3:0:0
|_    3:1:1

02Why enumeration matters on an internal network

Enumeration on an internal network matters because SMB is where credentials, scripts and sensitive files tend to pile up in plain sight. Once you are inside the perimeter, SMB is the shortest path from "I can reach a host" to "I have something useful". A single world-readable share can hold a backup of a config file with a connection string, a PowerShell script with a hardcoded password, or a spreadsheet of accounts. Even with no read access at all, the list of users and groups you pull from SMB feeds password spraying, Kerberoasting target selection, and the mental map of who the high-value accounts are.

This activity maps to MITRE ATT&CK T1135, Network Share Discovery, which is exactly what defenders tune their detections around. Knowing that helps you understand both why the technique works and how loud it is, which the detection section covers later.

03Null sessions and guest sessions

Null sessions and guest sessions are the two anonymous footholds that let you ask SMB questions without a real account. A null session is a connection to the hidden IPC$ share with an empty username and an empty password. On older Windows and on many Samba configurations it was allowed by default and let anyone enumerate users, groups and shares. A guest session uses the built-in Guest account, which, when enabled, grants a low-privilege anonymous foothold with similar reach.

Modern Windows restricts both. Null-session enumeration of the SAM is blocked by the RestrictAnonymous and RestrictAnonymousSAM settings, and guest fallback over SMB2 and SMB3 has been off by default since Windows 10 version 1709. That said, domain controllers still answer a surprising amount to an anonymous RPC bind, and misconfigured file servers and Samba boxes remain common in the wild, so testing for both is always worth the two minutes it costs.

04Enumerating shares, users, groups and sessions

Enumerating shares, users, groups and sessions is the core of the work, and each of those four things comes from a different RPC interface behind SMB. Shares come from SRVSVC, which answers NetShareEnumAll. Users and groups come from SAMR, the interface over the SAM database, which also returns the password policy. Account name to SID mapping comes from LSARPC, and the list of logged-on users and open sessions comes from SRVSVC and WKSSVC. You rarely call these by name, because your tools wrap them, but knowing the mapping explains why one command returns users and another returns nothing.

The single most valuable trick when the SAM is locked down is RID cycling. Every account has a SID that ends in a relative identifier, or RID, and the well-known ones are fixed: 500 is the local Administrator, 501 is Guest, 512 is Domain Admins. By asking LSARPC to translate SIDs in a range back to names, you can rebuild the user list even when a direct SAMR enumeration is refused. That one technique turns "access denied" into a full account list on many domain controllers.

05The tools, and when to reach for each

The tooling for SMB enumeration overlaps a lot, so the useful question is which tool to reach for first and when to switch. The short answer: start with netexec for a fast, wide sweep, drop to smbclient and rpcclient when you want to see exactly what the protocol returns, run enum4linux-ng when you want one command to collect everything, and use nmap scripts when you are already scanning and want SMB data folded into the same report. impacket fills the gaps with purpose-built scripts such as SID lookups.

smbclient is the plain FTP-style client for listing and browsing shares. It is the clearest way to confirm anonymous read access.

# list shares with a null session, then browse one anonymously
smbclient -L //10.10.10.5/ -N
smbclient //10.10.10.5/public -N

rpcclient talks to the RPC interfaces directly, which is where the user, group and policy data lives. It is manual but it shows you precisely what the box will answer anonymously.

# null-session RPC, then enumerate from the interactive prompt
rpcclient -U "" -N 10.10.10.5
# then, at the rpcclient $> prompt:
#   srvinfo            server version and type
#   enumdomusers       every domain / local user
#   querydominfo       domain and policy summary
#   enumdomgroups      groups
#   netshareenumall    shares with paths
#   lookupnames admin  name to SID
#   queryuser 0x1f4    detail for RID 500

enum4linux-ng is the modern rewrite of enum4linux. One command drives smbclient, rpcclient and more, then prints a structured report. It is the fastest way to collect everything at once.

# full automatic sweep: users, groups, shares, policy, OS
enum4linux-ng -A 10.10.10.5

netexec (nxc, the maintained successor to CrackMapExec) is built for scale and for credentialed checks later. The same binary enumerates one host or a whole subnet and does RID brute-forcing in one flag.

# anonymous sweep against one host
netexec smb 10.10.10.5 -u '' -p '' --shares --users --sessions --pass-pol
# rebuild the user list by cycling RIDs when direct enum is blocked
netexec smb 10.10.10.5 -u '' -p '' --rid-brute 4000

nmap ships a set of smb-* NSE scripts that are handy when SMB is just one service in a broader scan. They are less thorough than the dedicated tools but need nothing extra installed.

nmap -p139,445 --script "smb-os-discovery,smb-enum-shares,smb-enum-users,smb-enum-sessions,smb-security-mode" 10.10.10.5

impacket is the toolbox for the one-off jobs the others skip. lookupsid.py does clean anonymous SID cycling, and smbclient.py gives you a scriptable client.

# impacket SID brute via anonymous bind
lookupsid.py '[email protected]' -no-pass

06Reading share permissions and hunting sensitive files

Reading share permissions is the step that turns a share list into a loot list, because a name alone tells you nothing about whether you can get in. netexec marks each share READ, WRITE, or neither against your current session, which is the fastest triage. A writable share is often more dangerous than a readable one, since it can host a payload or poison a file that another user opens.

$ netexec smb 10.10.10.5 -u '' -p '' --shares
SMB  10.10.10.5  445  FS01  Share    Permissions   Remark
SMB  10.10.10.5  445  FS01  -------  -----------   ------
SMB  10.10.10.5  445  FS01  ADMIN$                 Remote Admin
SMB  10.10.10.5  445  FS01  C$                     Default share
SMB  10.10.10.5  445  FS01  IPC$     READ          Remote IPC
SMB  10.10.10.5  445  FS01  backup   READ          
SMB  10.10.10.5  445  FS01  transfer READ,WRITE    

Once you can read a share, hunt for the files that leak secrets. Config files, scripts, and backups are the usual winners: look for .config, .ps1, .bat, .vbs, .xml, web.config, unattend.xml, and anything named backup or old. On a domain controller the SYSVOL share is the classic target, because older Group Policy Preferences stored an encrypted-but-reversible password in Groups.xml, a flaw Microsoft documented in MS14-025. Recursive listing first, targeted download second, keeps the noise down.

# recurse a share and pull one file, non-interactively
smbclient //10.10.10.5/backup -N -c 'recurse ON; ls'
smbclient //10.10.10.5/backup -N -c 'get config/db.config db.config'

07A worked walkthrough against 10.10.10.5

A worked walkthrough ties the pieces together against a single lab host at 10.10.10.5, following the same order every time. The flow is always the same: fingerprint, test anonymous access, enumerate, then read what you can. Writing it out as steps makes the routine muscle memory.

$ rpcclient -U "" -N 10.10.10.5 -c "enumdomusers"
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[svc_backup] rid:[0x450]
user:[jwright] rid:[0x451]
user:[mchen] rid:[0x452]

At this point you have a host fingerprint, a user list, a group map, the password policy, and a short list of readable shares. That is enough to pick a spray target, confirm whether svc_backup has a weak password, and read whatever the backup share is holding. The enumeration did the hard part; the rest is a credential problem.

08Detecting SMB enumeration

Detecting SMB enumeration comes down to watching the right Windows event logs and the behaviour that enumeration creates, because the technique is loud once auditing is on. An anonymous logon shows up as Event ID 4624 with a logon type of 3 and the account name ANONYMOUS LOGON, which is the clearest single signal of a null session. With Audit Detailed File Share enabled, Event ID 5140 records a connection to a share and 5145 records access to individual files, so a client touching many shares or walking a tree generates a visible burst.

RID cycling and bulk user enumeration have their own fingerprint: a rapid series of SAMR and LSARPC calls from one source in a few seconds, which stands out in any SMB-aware network sensor. The practical detection is behavioural. Alert on anonymous logons to servers, on a single host connecting to many shares across the estate in a short window, and on RID-lookup bursts, rather than trying to match a specific tool's banner.

09Shutting down SMB enumeration

Shutting down SMB enumeration is about removing the anonymous reach and shrinking what any one account can see, not about blocking the protocol outright. The fixes below are standard Windows and Samba hardening, applied in order of impact. None of them break legitimate file sharing when scoped correctly.

10FAQ

11Wrapping up

SMB enumeration rewards patience over cleverness: fingerprint the service, test the anonymous paths, map shares, users, groups and sessions, then read what your session allows. The same four RPC interfaces answer every tool, so once you understand what SRVSVC, SAMR and LSARPC return, switching between netexec, rpcclient, enum4linux-ng, nmap and impacket is just a matter of preference. Learn the flow on a lab box like 10.10.10.5, and remember that the defender's job is the mirror image: remove the null session, shrink the share, and turn on the audit log that makes the whole technique visible.