SMB and MS-RPC Enumeration

Copysmbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
smbclient -L //TARGET -U 'TARGET/USER'
smbclient -L //TARGET -U 'guest%'

The first two forms use a domain identity, the third makes a local target account explicit, and the fourth tests a guest account with an empty password. Let the client prompt for non-empty passwords. Inside the share:

Copypwd
ls
allinfo FILE
get FILE
mkdir probe-dir
rmdir probe-dir
exit

Use a harmless uniquely named directory only when write permission must be verified. A successful create/remove establishes share-level write access, not code execution.

Copysmbclient //TARGET/SHARE -U 'DOMAIN/USER' -c 'recurse ON;prompt OFF;mget *'

Run from a dedicated local evidence directory and review expected volume first. Search downloaded configuration, scripts, backups, keys and unattended-install files locally; never publish recovered data.

Copyrpcclient -U '' -N TARGET
rpcclient -U 'DOMAIN/USER' TARGET

Useful interactive queries:

Copysrvinfo
enumdomains
enumdomusers
enumdomgroups
queryuser RID
netshareenumall
quit

Null-session denial is common on modern systems. Authenticated output must be labelled with the identity that produced it.

Copynxc smb TARGET -u USER -p PASSWORD --shares
enum4linux-ng -A TARGET

NetExec (nxc) is the current command name on recent Kali releases; older material may use crackmapexec. These tools consolidate candidates. Confirm useful shares and files with smbclient or native access.

Copynmap -p 139,445 --script smb-protocols,smb2-security-mode,smb2-time TARGET

Signing and dialect results affect later relay/exploit decisions but are not vulnerabilities by themselves. The older smb-os-discovery script depends on SMBv1 behavior and may not identify modern hosts reliably.

Copynet view \\TARGET /all
Get-ChildItem \\TARGET\SHARE
Get-Content \\TARGET\SHARE\FILE

These use the current Windows logon context unless alternate credentials or mappings are established. An existing connection to the same server under another identity can cause credential-conflict errors.

Use from Kali when SMB is reachable. Choose the same domain/local identity that worked with smbclient. Suppress write probes when inventorying reads; this means a writable label is not being tested here.

Copy# Known domain account: enumerate share access without creating a probe file
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --no-write-check

# Inspect the selected share to a bounded depth
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' -r 'SHARE' --depth 2 --no-write-check

# Download the specific file found above
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --download 'SHARE\PATH\FILE' --no-write-check

Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.

SMBMap upstream. For broader SMB/RPC collection, use the existing enum4linux-ng baseline; authenticate explicitly when credentials exist:

Copy# No credentials: anonymous RPC/SMB candidates
enum4linux-ng -A TARGET

# Known identity: domain objects visible to this account
enum4linux-ng -A -w DOMAIN -u USER -p 'PASSWORD' TARGET

Next: validate returned users/groups/shares with rpcclient or smbclient. A collector can return partial data despite a successful login.