9.2.6 Find shares, identities and rights through SMB and RPC SMB and MS-RPC Enumeration
← Stage index · Cheatsheet | Strategy map | Study methods: Extract opportunities from services
Recognize: direct-hosted SMB commonly uses TCP/445; NetBIOS session service commonly uses TCP/139; MS-RPC endpoint mapping commonly uses TCP/135. They are related Windows surfaces but not interchangeable. Goal: distinguish null, guest and authenticated contexts; enumerate shares, files, users, groups, domain/workgroup clues and actual permissions.
9.2.6.1 Baseline: list shares without credentials
smbclient -N -L //TARGET
Decisive output: a share list proves that this access context can enumerate names. It does not prove access to share contents.
NT_STATUS_ACCESS_DENIEDmeans this context was denied; repeat after obtaining a legitimate credential.
9.2.6.1.1 Variant — authenticated share listing and connection
smbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
smbclient -L //TARGET -U 'TARGET/USER'
smbclient -L //TARGET -U 'guest%'
The first two forms use a domain identity, the third makes a local target account explicit, and the fourth tests a guest account with an empty password. Let the client prompt for non-empty passwords. Inside the share:
pwd
ls
allinfo FILE
get FILE
mkdir probe-dir
rmdir probe-dir
exit
Use a harmless uniquely named directory only when write permission must be verified. A successful create/remove establishes share-level write access, not code execution.
9.2.6.1.2 Variant — recursive retrieval
smbclient //TARGET/SHARE -U 'DOMAIN/USER' -c 'recurse ON;prompt OFF;mget *'
Run from a dedicated local evidence directory and review expected volume first. Search downloaded configuration, scripts, backups, keys and unattended-install files locally; never publish recovered data.
9.2.6.1.3 Variant — RPC null or authenticated session
rpcclient -U '' -N TARGET
rpcclient -U 'DOMAIN/USER' TARGET
Useful interactive queries:
srvinfo
enumdomains
enumdomusers
enumdomgroups
queryuser RID
netshareenumall
quit
Null-session denial is common on modern systems. Authenticated output must be labelled with the identity that produced it.
9.2.6.1.4 Variant — fast permission summary and consolidated candidates
nxc smb TARGET -u USER -p PASSWORD --shares
enum4linux-ng -A TARGET
NetExec (nxc) is the current command name on recent Kali releases; older material may use crackmapexec. These tools consolidate candidates. Confirm useful shares and files with smbclient or native access.
9.2.6.1.5 Variant — protocol, signing and time clues
nmap -p 139,445 --script smb-protocols,smb2-security-mode,smb2-time TARGET
Signing and dialect results affect later relay/exploit decisions but are not vulnerabilities by themselves. The older smb-os-discovery script depends on SMBv1 behavior and may not identify modern hosts reliably.
9.2.6.1.6 Variant — Windows built-ins
net view \\TARGET /all
Get-ChildItem \\TARGET\SHARE
Get-Content \\TARGET\SHARE\FILE
These use the current Windows logon context unless alternate credentials or mappings are established. An existing connection to the same server under another identity can cause credential-conflict errors.
9.2.6.1.7 SMBMap — map rights, then read one useful file
Use from Kali when SMB is reachable. Choose the same domain/local identity that worked with smbclient. Suppress write probes when inventorying reads; this means a writable label is not being tested here.
9.2.6.1.8 Known domain account: enumerate share access without creating a probe file
# Known domain account: enumerate share access without creating a probe file
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --no-write-check9.2.6.1.9 Inspect the selected share to a bounded depth
# Inspect the selected share to a bounded depth
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' -r 'SHARE' --depth 2 --no-write-check9.2.6.1.10 Download the specific file found above
# Download the specific file found above
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --download 'SHARE\PATH\FILE' --no-write-check
Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.
SMBMap upstream. For broader SMB/RPC collection, use the existing enum4linux-ng baseline; authenticate explicitly when credentials exist:
9.2.6.1.11 No credentials: anonymous RPC/SMB candidates
# No credentials: anonymous RPC/SMB candidates
enum4linux-ng -A TARGET9.2.6.1.12 Known identity: domain objects visible to this account
# Known identity: domain objects visible to this account
enum4linux-ng -A -w DOMAIN -u USER -p 'PASSWORD' TARGET
Next: validate returned users/groups/shares with rpcclient or smbclient. A collector can return partial data despite a successful login.
Failure cues: distinguish connection failure, authentication failure, share enumeration denial and file authorization denial. A share named
IPC$is not a general file share. Guest acceptance may look like success while returning a restricted namespace. A share marked writable still needs a consumer/trigger before it becomes an execution path.
Next action: inspect readable content, record per-share rights, validate names/domain clues, and re-run authenticated enumeration whenever identity changes. Move file-consumer hypotheses to web/execution/escalation and signing/relay hypotheses to the later credential/AD blocks.
9.2.6.2 NetBIOS names before SMB enumeration
Use when UDP/137 or SMB suggests Windows names but DNS/domain identity is unclear.
# Ask the assigned host for its NetBIOS names
nbtscan TARGET
nmblookup -A TARGET
Read: a machine name and group/domain label are leads. A workgroup label does not prove AD membership. Resolve the returned name and use the SMB/LDAP checks with the accepted identity. No reply can mean filtering or disabled NetBIOS while TCP/445 still works.
Sources: upstream 1.
9.2.6.3 SMB/RPC RID lookups when a normal user listing is denied
Use when the accepted identity can translate SIDs but cannot list the directory directly. Keep the queried host/domain and a bounded RID range explicit.
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --rid-brute 4000
Read: classify returned SID types—users, groups and machine accounts are different objects. The upper bound is coverage, not proof that higher RIDs contain nothing. A resolved name is not a password, service authorization or successful logon. Prefer the existing native directory/RPC listing when it is available; do not infer no accounts from a single denied enumeration method.
Sources: upstream 1.