> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/rpc-discovery/net.md).
# net
net from Samba is a tool for administration of Samba and remote CIFS servers.
## Enumeration
### Enumerate users
To list users via DCE/RPC
```bash
net rpc user -U domain.local/user%'Password' -S $TARGET_IP
```
Note that `%` is used as delimiter instead of `:` as in Impacket!
Example run
```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ net rpc user -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP
Administrator
dave
Guest
iis_service
jeff
jeffadmin
jen
krbtgt
pete
stephanie
```
### Enumerate groups
To list domain groups via DCE/RPC
```bash
net rpc group -U domain.local/user%'Password' -S $TARGET_IP
```
Note that `%` is used as delimiter instead of `:` as in Impacket!
Example run
```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ net rpc group -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP
Cloneable Domain Controllers
Debug
Development Department
DnsUpdateProxy
Domain Admins
Domain Computers
Domain Controllers
Domain Guests
Domain Users
Enterprise Admins
Enterprise Key Admins
Enterprise Read-only Domain Controllers
Group Policy Creator Owners
Key Admins
Management Department
Protected Users
Read-only Domain Controllers
Sales Department
Schema Admins
Cert Publishers
RAS and IAS Servers
Allowed RODC Password Replication Group
Denied RODC Password Replication Group
DnsAdmins
Server Operators
Account Operators
Pre-Windows 2000 Compatible Access
Incoming Forest Trust Builders
Windows Authorization Access Group
Terminal Server License Servers
Administrators
Users
Guests
Print Operators
Backup Operators
Replicator
Remote Desktop Users
Network Configuration Operators
Performance Monitor Users
Performance Log Users
Distributed COM Users
IIS_IUSRS
Cryptographic Operators
Event Log Readers
Certificate Service DCOM Access
RDS Remote Access Servers
RDS Endpoint Servers
RDS Management Servers
Hyper-V Administrators
Access Control Assistance Operators
Remote Management Users
Storage Replica Administrators
```
## Usage information
net help user
```bash
┌──(kali㉿kali)-[~]
└─$ net help user
net [] user [misc. options] [targets]
List users
net [] user DELETE [misc. options] [targets]
Delete specified user
net [] user INFO [misc. options] [targets]
List the domain groups of the specified user
net [] user ADD [password] [-c container] [-F user flags] [misc. options] [targets]
Add specified user
net [] user RENAME [targets]
Rename specified user
Valid methods: (auto-detected if not specified)
ads Active Directory (LDAP/Kerberos)
rpc DCE-RPC
rap RAP (older systems)
Valid targets: choose one (none defaults to localhost)
-S|--server= server name
-I|--ipaddress= address of target server
-w|--target-workgroup= target workgroup or domain
Valid misc options are:
-p|--port= connection port on target
--myname= client name
--long Display full information
Valid common options are:
-d|--debuglevel= debug level (0-10)
--debug-stdout Send debug output to standard output
--configfile= pathname of smb.conf file
--option=name=value Set smb.conf option from command line
-l|--log-basename=LOGFILEBASE Basename for log/debug files
--leak-report enable talloc leak reporting on exit
--leak-report-full enable full talloc leak reporting on exit
-V|--version Print samba version information
Valid connection options are:
-R|--name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only
-O|--socket-options=SOCKETOPTIONS socket options to use
-m|--max-protocol=MAXPROTOCOL Set max protocol level
-n|--netbiosname=NETBIOSNAME Primary netbios name
--netbios-scope=SCOPE Use this Netbios scope
-W|--workgroup=WORKGROUP Set the workgroup name
--realm=REALM Set the realm name
Valid credential options are:
-U|--user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username
-N|--no-pass Don't ask for a password
--password=STRING Set a password
--pw-nt-hash The supplied password is the NT hash
-A|--authentication-file=FILE Get the credentials from a file
-P|--machine-pass Use stored machine account password
--simple-bind-dn=DN DN to use for a simple bind
--use-kerberos=desired|required|off Use kerberos authentication
--use-krb5-ccache=CCACHE Credentials cache location for Kerberos
--use-winbind-ccache Use the winbind ccache for authentication
--client-protection=sign|encrypt|off Configure used protection for client connections
-C or --comment= descriptive comment (for add only)
-c or --container= LDAP container, defaults to cn=Users (for add in ADS only)
```
net help group
```bash
┌──(kali㉿kali)-[~]
└─$ net help group
net [] group [misc. options] [targets]
List user groups
net rpc group LIST [global|local|builtin]* [misc. options]
List specific user groups
net [] group DELETE [misc. options] [targets]
Delete specified group
net [] group ADD [-C comment] [-c container] [misc. options] [targets]
Create specified group
net rpc group MEMBERS
List Group Members
net rpc group ADDMEM
Add Group Members
net rpc group DELMEM
Delete Group Members
Valid methods: (auto-detected if not specified)
ads Active Directory (LDAP/Kerberos)
rpc DCE-RPC
rap RAP (older systems)
Valid targets: choose one (none defaults to localhost)
-S|--server= server name
-I|--ipaddress= address of target server
-w|--target-workgroup= target workgroup or domain
Valid misc options are:
-p|--port= connection port on target
--myname= client name
--long Display full information
Valid common options are:
-d|--debuglevel= debug level (0-10)
--debug-stdout Send debug output to standard output
--configfile= pathname of smb.conf file
--option=name=value Set smb.conf option from command line
-l|--log-basename=LOGFILEBASE Basename for log/debug files
--leak-report enable talloc leak reporting on exit
--leak-report-full enable full talloc leak reporting on exit
-V|--version Print samba version information
Valid connection options are:
-R|--name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only
-O|--socket-options=SOCKETOPTIONS socket options to use
-m|--max-protocol=MAXPROTOCOL Set max protocol level
-n|--netbiosname=NETBIOSNAME Primary netbios name
--netbios-scope=SCOPE Use this Netbios scope
-W|--workgroup=WORKGROUP Set the workgroup name
--realm=REALM Set the realm name
Valid credential options are:
-U|--user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username
-N|--no-pass Don't ask for a password
--password=STRING Set a password
--pw-nt-hash The supplied password is the NT hash
-A|--authentication-file=FILE Get the credentials from a file
-P|--machine-pass Use stored machine account password
--simple-bind-dn=DN DN to use for a simple bind
--use-kerberos=desired|required|off Use kerberos authentication
--use-krb5-ccache=CCACHE Credentials cache location for Kerberos
--use-winbind-ccache Use the winbind ccache for authentication
--client-protection=sign|encrypt|off Configure used protection for client connections
-C or --comment= descriptive comment (for add only)
-c or --container= LDAP container, defaults to cn=Users (for add in ADS only)
-L or --localgroup When adding groups, create a local group (alias)
```
## Resources
**net** - Kali Tools: