SMBclient - Connecting to the Share
smbclient -N -L //10.10.10.10
Lists all the available SMB shares on the target machine without providing a password (-N).
smbclient //10.10.10.10/sharename
Connects directly to a specific share (replace sharename with the actual share name you found).
Download Files from SMB
Downloads a single file from the SMB share to your local machine.
Downloads multiple files at once that match the pattern — here, any file starting with “dog.” This is a quick way to grab many files.
sudo nmap 10.10.10.10 -sV -sC -p139,445
Scans the target for SMB services on ports 139 and 445, running default scripts (-sC) and service version detection (-sV).
Enumerating SMB
Connects to the RPC service over SMB with an empty username. This lets you run RPC commands to gather information about users, groups, and policies.
Authentication & Info
srvinfo → Show OS version, server version, and platform info.
Example: rpcclient $> srvinfo
enumdomains → List domains the server is part of.
lsaquery → Get domain and server name.
netshareenumall → Enumerate all shares (lists name, remark, path).
netsharegetinfo → Details about a specific share (path, remark, permissions).
enumdomusers → List all domain users.
enumdomgroups → List all domain groups.
enumalsgroups domain → List all aliases in the domain (local groups).
queryuser → Get detailed info about a user (e.g., last logon, full name).
querygroup → Get detailed info about a group.
lookupsids → Resolve a SID to a name.
lookuprids → Translate RIDs to names.
lsaenumsid → Enumerate SIDs on the system.
Password Policies
getdompwinfo → Get domain password policy (min length, history, etc.).
querydominfo → Domain info, including password reset and lockout policy.
Other Handy Commands
lsaenumsid → Enumerate Security Identifiers (SIDs).
lsaquerytargetinfo → Get target computer info (NetBIOS, DNS, etc.).
lsaenumtrustdom → Enumerate trusted domains.
Always start with:
Then dig deeper into users:
If you find a domain SID:
Brute forcing users RID’s
This loops through a range of RIDs (Relative Identifiers) to try and enumerate user accounts. It prints usernames and IDs if found.
Impacket - Samrdump.py
Uses Impacket’s tool to dump information about users and groups from the SAMR service on the target system.
Maps out the accessible shares and permissions. This shows what you can read, write, or access on each share.
NXC (CrackMapExec)
A powerful tool to enumerate SMB shares. The empty username (-u '') and password (-p '') test for null sessions.
Enum4Linux-ng - Installation
Installs Enum4Linux-ng, a modern rework of the classic Enum4Linux tool.
Runs all available enumeration modules (-A) against the target SMB host.
Last updated