> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/smb-discovery/enum.exe-enum4linux-enum4linux-ng.md). # Enum.exe / enum4linux / enum4linux-ng **Enum.exe** is a console-based Win32 information enumeration utility. Using null sessions, enum can retrieve userlists, machine lists, sharelists, namelists, group and member lists, password and LSA policy information. enum.exe is also capable of a rudimentary brute force dictionary attack on individual accounts. *** **Enum4linux** is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from [www.bindview.com](https://www.bindview.com). It is written in PERL and is basically a wrapper around the Samba tools smbclient, rpclient, net and nmblookup. The samba package is therefore a dependency. *** **enum4linux-ng.py** is a rewrite of Mark Lowe's (former Portcullis Labs now Cisco CX Security Labs) enum4linux.pl, a tool for enumerating information from Windows and Samba systems, aimed for security professionals and CTF players. The tool is mainly a wrapper around the Samba tools `nmblookup`, `net`, `rpcclient` and `smbclient`. I made it for educational purposes for myself and to overcome issues with enum4linux.pl. It has the same functionality as the original tool (though it does some things [differently](https://github.com/cddmp/enum4linux-ng#Differences)). Other than the original tool it parses all output of the Samba tools and allows to export all findings as YAML or JSON file. The idea behind this is to allow other tools to import the findings and further process them. It is planned to add new features in the future. Some things are implemented differently compared to the original enum4linux. These are the important differences: * RID cycling is not part of the default enumeration (`-A`) but can be enabled with `-R` * RID cycling can be achieved faster, by grouping multiple SID lookups in the same rpcclient call * parameter naming is slightly different (e.g. `-A` instead of `-a`) ## Full enumeration Do all (`-a`) simple enumeration unauthenticated (Null session). `-a` equals `-U`, `-S`, `-G`, `-P`, `-r`, `-o`, `-n`, and `-i`. ```bash enum4linux -a $TARGET_IP | tee enum4linux.txt ``` Full enumeration is the default for enum4linux-ng, but the explicit parameter is `-A`. Unauthenticated ```bash enum4linux-ng $TARGET_IP | tee enum4linux-ng.txt ``` Authenticated ```bash enum4linux-ng -u -p $TARGET_IP | tee enum4linux-ng.txt ``` enum4linux-ng will also try to enumerate over the LDAP-port (389/tcp). ## Usage information
enum.exe ```batch usage: enum.exe [switches] [hostname|ip] -U: get userlist -M: get machine list -N: get namelist dump (different from -U|-M) -S: get sharelist -P: get password policy information -G: get group and member list -L: get LSA policy information -D: dictionary crack, needs -u and -f -d: be detailed, applies to -U and -S -c: don't cancel sessions -u: specify username to use (default "") -p: specify password to use (default "") -f: specify dictfile to use (wants -D) ```
enum4linux -h ```bash ┌──(kali㉿kali)-[~] └─$ enum4linux -h enum4linux v0.9.1 (http://labs.portcullis.co.uk/application/enum4linux/) Copyright (C) 2011 Mark Lowe (mrl@portcullis-security.com) Simple wrapper around the tools in the samba package to provide similar functionality to enum.exe (formerly from www.bindview.com). Some additional features such as RID cycling have also been added for convenience. Usage: ./enum4linux.pl [options] ip Options are (like "enum"): -U get userlist -M get machine list* -S get sharelist -P get password policy information -G get group and member list -d be detailed, applies to -U and -S -u user specify username to use (default "") -p pass specify password to use (default "") The following options from enum.exe aren't implemented: -L, -N, -D, -f Additional options: -a Do all simple enumeration (-U -S -G -P -r -o -n -i). This option is enabled if you don't provide any other options. -h Display this help message and exit -r enumerate users via RID cycling -R range RID ranges to enumerate (default: 500-550,1000-1050, implies -r) -K n Keep searching RIDs until n consective RIDs don't correspond to a username. Impies RID range ends at 999999. Useful against DCs. -l Get some (limited) info via LDAP 389/TCP (for DCs only) -s file brute force guessing for share names -k user User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none) Used to get sid with "lookupsid known_username" Use commas to try several users: "-k admin,user1,user2" -o Get OS information -i Get printer information -w wrkg Specify workgroup manually (usually found automatically) -n Do an nmblookup (similar to nbtstat) -v Verbose. Shows full commands being run (net, rpcclient, etc.) -A Aggressive. Do write checks on shares etc RID cycling should extract a list of users from Windows (or Samba) hosts which have RestrictAnonymous set to 1 (Windows NT and 2000), or "Network access: Allow anonymous SID/Name translation" enabled (XP, 2003). NB: Samba servers often seem to have RIDs in the range 3000-3050. Dependancy info: You will need to have the samba package installed as this script is basically just a wrapper around rpcclient, net, nmblookup and smbclient. Polenum from http://labs.portcullis.co.uk/application/polenum/ is required to get Password Policy info. ```
enum4linux-ng -h ```bash ┌──(kali㉿kali)-[~] └─$ enum4linux-ng -h ENUM4LINUX - next generation (v1.3.4) usage: enum4linux-ng [-h] [-A] [-As] [-U] [-G] [-Gm] [-S] [-C] [-P] [-O] [-L] [-I] [-R [BULK_SIZE]] [-N] [-w DOMAIN] [-u USER] [-p PW | -K TICKET_FILE | -H NTHASH] [--local-auth] [-d] [-k USERS] [-r RANGES] [-s SHARES_FILE] [-t TIMEOUT] [-v] [--keep] [-oJ OUT_JSON_FILE | -oY OUT_YAML_FILE | -oA OUT_FILE] host This tool is a rewrite of Mark Lowe's enum4linux.pl, a tool for enumerating information from Windows and Samba systems. It is mainly a wrapper around the Samba tools nmblookup, net, rpcclient and smbclient. Other than the original tool it allows to export enumeration results as YAML or JSON file, so that it can be further processed with other tools. The tool tries to do a 'smart' enumeration. It first checks whether SMB or LDAP is accessible on the target. Depending on the result of this check, it will dynamically skip checks (e.g. LDAP checks if LDAP is not running). If SMB is accessible, it will always check whether a session can be set up or not. If no session can be set up, the tool will stop enumeration. The enumeration process can be interupted with CTRL+C. If the options -oJ or -oY are provided, the tool will write out the current enumeration state to the JSON or YAML file, once it receives SIGINT triggered by CTRL+C. The tool was made for security professionals and CTF players. Illegal use is prohibited. positional arguments: host options: -h, --help show this help message and exit -A Do all simple enumeration including nmblookup (-U -G -S -P -O -N -I -L). This option is enabled if you don't provide any other option. -As Do all simple short enumeration without NetBIOS names lookup (-U -G -S -P -O -I -L) -U Get users via RPC -G Get groups via RPC -Gm Get groups with group members via RPC -S Get shares via RPC -C Get services via RPC -P Get password policy information via RPC -O Get OS information via RPC -L Get additional domain info via LDAP/LDAPS (for DCs only) -I Get printer information via RPC -R [BULK_SIZE] Enumerate users via RID cycling. Optionally, specifies lookup request size. -N Do an NetBIOS names lookup (similar to nbtstat) and try to retrieve workgroup from output -w DOMAIN Specify workgroup/domain manually (usually found automatically) -u USER Specify username to use (default "") -p PW Specify password to use (default "") -K TICKET_FILE Try to authenticate with Kerberos, only useful in Active Directory environment -H NTHASH Try to authenticate with hash --local-auth Authenticate locally to target -d Get detailed information for users and groups, applies to -U, -G and -R -k USERS User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none). Used to get sid with "lookupsids" -r RANGES RID ranges to enumerate (default: 500-550,1000-1050) -s SHARES_FILE Brute force guessing for shares -t TIMEOUT Sets connection timeout in seconds (default: 5s) -v Verbose, show full samba tools commands being run (net, rpcclient, etc.) --keep Don't delete the Samba configuration file created during tool run after enumeration (useful with -v) -oJ OUT_JSON_FILE Writes output to JSON file (extension is added automatically) -oY OUT_YAML_FILE Writes output to YAML file (extension is added automatically) -oA OUT_FILE Writes output to YAML and JSON file (extensions are added automatically) ```
## Resources **enum4linux** - Github: **enum4linux** - Homepage: **enum4linux** - Kali Tools: **enum4linux-ng** - GitHub: **enum4linux-ng** - Kali Tools: