enum4linux

name	enum4linux
description	Auth/lab ref: enum4linux SMB/Samba enumeration; users, shares, groups, OS info, password policy, null-session evidence.
license	GPL-2.0
compatibility	Linux.
metadata	{"author":"AeonDave","version":"1.0"}

enum4linux

SMB enumeration tool — extracts users, shares, groups, and domain info from Windows/Samba hosts.

Quick Start

# Full enumeration (null session)
enum4linux -a 192.168.1.10

# With credentials
enum4linux -a -u admin -p password 192.168.1.10

# Modern rewrite (enum4linux-ng recommended)
enum4linux-ng -A 192.168.1.10

Flags (Classic)

Flag	Description
-a	All: runs -U -S -G -P -r -o -n -i
-U	User list via RPC
-M	Machine list
-S	Share enumeration
-P	Password policy
-G	Group enumeration
-r	User list via RID cycling
-R <range>	RID range (default 500-550,1000-1050)
-u <user>	Username for auth
-p <pass>	Password for auth
-d	Debug mode
-v	Verbose
-o	Get OS information
-i	Printer info
-n	Nmblookup info

enum4linux-ng Flags (Recommended)

Flag	Description
-A	All checks
-u <user>	Username
-p <pass>	Password
-oJ <file>	JSON output
-oY <file>	YAML output
-t <n>	Timeout
--no-color	Disable color output

Common Workflows

# Full null session enum (no creds)
enum4linux -a 10.10.10.100

# Authenticated full enum
enum4linux -a -u "DOMAIN\user" -p "password" 10.10.10.100

# RID cycling for user enumeration
enum4linux -r -R 500-2000 10.10.10.100

# Modern approach with JSON output
enum4linux-ng -A 10.10.10.100 -oJ output.json

# Share enumeration only
enum4linux -S 10.10.10.100

# Password policy extraction
enum4linux -P 10.10.10.100

Key Info Extracted

• Domain/workgroup name and OS version
• User accounts (via RPC and RID brute-force)
• Shares (writable/readable)
• Group memberships
• Password policy (lockout threshold, complexity)
• Printer and session info

Resources

File	When to load
references/smb-enumeration.md	SMB enumeration techniques, smbclient commands, null session exploitation