SMB Enumeration Cheatsheet
nmap SMB Scripts
smb-os-discovery
Identify OS version and computer name via SMB.
nmap -p 445 --script smb-os-discovery <target>
nmap -p 445 --script smb-os-discovery -Pn <target> # skip host discovery
smb-enum-shares
Enumerate SMB shares (with optional credentials).
nmap -p 445 --script smb-enum-shares <target>
nmap -p 445 --script smb-enum-shares --script-args smbusername=admin,smbpass=pass <target>
smb-enum-users
Enumerate domain users via SMB RPC.
nmap -p 445 --script smb-enum-users <target>
nmap -p 445 --script smb-enum-users --script-args smbusername=admin,smbpass=pass <target>
Run multiple SMB scripts at once
nmap -p 445 --script "smb-*" <target>
nmap -p 445 --script "smb-enum-*" <target> # only enum scripts
nmap -p 445 --script "smb-os-discovery,smb-enum-shares,smb-enum-users" <target>
Other useful nmap SMB scripts
nmap -p 445 --script smb-security-mode <target> # signing, SMB version info
nmap -p 445 --script smb-protocols <target> # supported SMB dialects
nmap -p 445 --script smb2-capabilities <target> # SMB2 capabilities
nmap -p 445 --script smb-vuln-ms17-010 <target> # EternalBlue check
smbclient
Null session (no credentials)
smbclient -N -L //<target> # list shares anonymously
smbclient -N //<target>/share_name # connect to a share
With credentials
smbclient -L //<target> -U <username> # list shares with creds
smbclient //<target>/share -U <username> # connect to a share
smbclient -L //<target> -U DOMAIN/username # domain user
Useful smbclient commands (once connected)
ls # list files
cd dir # change directory
get file # download a file
put file # upload a file
prompt # toggle interactive mode off for mget/mput
mget * # download all files
recurse ON # enable recursion for downloads
exit # quit
rpcclient
Null session
rpcclient -N -U "" <target>
rpcclient -N -U "%" <target>
User enumeration
enumdomusers # list all domain users
queryuser <rid> # query user details by RID
queryuser 0x1f4 # query user by hex RID (500 = admin)
queryuser 0x1f5 # query Guest user (501)
queryusergroups <rid> # get user's group memberships
querygroupmem <rid> # list members of a group
Group enumeration
enumdomgroups # list all domain groups
querygroup <rid> # query group details
queryaliasmem <rid> # list alias (local group) members
enumalsgroups builtin # list built-in alias groups
enumalsgroups domain # list domain alias groups
Other useful rpcclient commands
srvinfo # server info
enumdomains # enumerate domains
lookupnames <username> # resolve username → SID
lookupsids <sid> # resolve SID → name
lsaquery # LSA policy info
lsaenumsid # enumerate trusted domains
netshareenum # enumerate shares
netshareenumall # enumerate all shares (including hidden)
dsroledom # get domain role (PDC/BDC)
Examples — full workflow
# Null session enumeration
rpcclient -N -U "" 10.10.10.10
> enumdomusers
> enumdomgroups
> queryuser 0x1f4
> lookupnames Administrator
> netshareenumall
# With credentials
rpcclient -U "DOMAIN/user%password" 10.10.10.10
> enumdomusers
> queryuser 500
crackmapexec / NetExec (nxc)
SMB users
# Enumerate domain users
crackmapexec smb <target> --users
nxc smb <target> --users
# Enumerate users with credentials
crackmapexec smb <target> -u <user> -p <pass> --users
nxc smb <target> -u <user> -p <pass> --users
# Brute-force/rid brute to enumerate users
nxc smb <target> -u <user> -p <pass> --rid-brute
nxc smb <target> -u '' -p '' --rid-brute # null session rid brute
SMB shares
# Enumerate shares (anonymous)
nxc smb <target> -u '' -p '' --shares
# Enumerate shares with credentials
nxc smb <target> -u <user> -p <pass> --shares
# Enumerate shares + check read access
nxc smb <target> -u <user> -p <pass> --shares -q # quiet, just readable shares
# Sparse file info
nxc smb <target> --spider <share> --pattern .txt
Sessions and other info
# Enumerate logged-on users
nxc smb <target> -u <user> -p <pass> --sessions
# Check if SMB signing is enabled
nxc smb <target> --gen-relay-list relay.txt
# Execute commands via SMB (wmiexec-style)
nxc smb <target> -u <user> -p <pass> -x whoami
nxc smb <target> -u <user> -p <pass> -X 'Get-Process' # PowerShell
Pass-the-hash with nxc
nxc smb <target> -u <user> -H <NTLMhash> --shares
nxc smb <target> -u <user> -H <NTLMhash> -x whoami
enum4linux-ng
Basic enumeration
enum4linux-ng <target> # full enumeration
enum4linux-ng <target> -A # all simple enumeration
enum4linux-ng <target> -u <user> -p <pass> # with credentials
enum4linux-ng <target> -n # just nmblookup (NetBIOS)
enum4linux-ng <target> -U # just user enumeration
enum4linux-ng <target> -S # just share enumeration
enum4linux-ng <target> -G # just group enumeration
enum4linux-ng <target> -P # just password policy
enum4linux-ng <target> -O # just OS information
enum4linux-ng <target> -R # just RID cycling
Useful flags
enum4linux-ng <target> -A -C # all checks + color output
enum4linux-ng <target> -A -oY out.yaml # output as YAML
enum4linux-ng <target> -A -oJ out.json # output as JSON
enum4linux-ng <target> -q # quiet, suppress banner
Old enum4linux (perl version)
enum4linux <target>
enum4linux -a <target> # do all simple enumeration
enum4linux -u <user> -p <pass> -a <target>
smbmap
Basic usage
# Null session
smbmap -H <target>
smbmap -H <target> -u '' -p ''
# With credentials
smbmap -H <target> -u <user> -p <pass>
smbmap -H <target> -u <user> -p <pass> -d <domain>
# Pass-the-hash
smbmap -H <target> -u <user> -p <pass> -H <LM:NT>
Recursive share enumeration
smbmap -H <target> -R # recursive listing of all shares
smbmap -H <target> -R -A .txt # recursive + download .txt files
smbmap -H <target> -R -A . -q # recursive + download everything, quiet
Download/upload with smbmap
smbmap -H <target> --download <share\path\to\file>
smbmap -H <target> --upload /local/file <share\remote\path>
smbmap -H <target> -r <share> # recursively list a specific share
Execute commands (winexe-style)
smbmap -H <target> -u <user> -p <pass> -x 'ipconfig'
smbmap -H <target> -u <user> -p <pass> --exec-cmd 'whoami'
Smbmap with share list
smbmap -H <target> -u <user> -p <pass> -d <domain> --only-users # only list accessible shares
Quick Reference — Common Workflows
Anonymous / Null Session Enumeration
# 1. Quick SMB version and OS
nmap -p 445 --script smb-os-discovery,smb-security-mode <target>
# 2. List shares via null session
smbclient -N -L //<target>
nxc smb <target> -u '' -p '' --shares
# 3. Enumerate users (null session)
nxc smb <target> --rid-brute -u '' -p ''
rpcclient -N -U "" <target> -c "enumdomusers"
# 4. Full enum4linux-ng sweep
enum4linux-ng <target> -A
Authenticated Enumeration
# 1. Full share enumeration
nxc smb <target> -u <user> -p <pass> --shares
smbmap -H <target> -u <user> -p <pass> -R
# 2. User enumeration
nxc smb <target> -u <user> -p <pass> --users
# 3. Sessions
nxc smb <target> -u <user> -p <pass> --sessions
# 4. rpcclient full sweep
rpcclient -U "DOMAIN/user%pass" <target> -c "enumdomusers;enumdomgroups;netshareenumall;srvinfo"