BeginnerTools

Enum4Linux Guide: Windows/Samba Enumeration

Learn Enum4Linux for enumerating Windows and Samba systems including user lists, shares, groups, and security policy information.

#enum4linux#Samba#Windows enumeration#smb#network reconnaissance

Why You Need Enum4Linux

You have discovered an open SMB port on a Windows or Samba system — Enum4Linux automates the extraction of shares, users, groups, and password policies. It wraps smbclient, rpcclient, and other Samba tools to give you a complete picture of what the target exposes over SMB.

Prerequisites

Understanding of Windows networking and Active Directory

Familiarity with SMB protocol

Network access to the target

How Enum4Linux Works

Null Session: Connects without credentials, accessing RPC services anonymously.

User Enumeration: Lists users through SAMR and LSA RPC interfaces.

Share Enumeration: Lists available SMB shares and permissions.

Password Policy: Retrieves lockout thresholds and complexity.

Installation

sudo apt install enum4linux

Basic Usage

enum4linux 192.168.1.100
enum4linux -a 192.168.1.100

Enumeration Examples

# Full enumeration
enum4linux -a 192.168.1.100

# Users only
enum4linux -U 192.168.1.100

# Shares only
enum4linux -S 192.168.1.100

# Password policy
enum4linux -P 192.168.1.100

# Authenticated
enum4linux -u administrator -p password123 -a 192.168.1.100

Common Mistakes

Null sessions don't work on modern Windows. Ignoring share permissions. Not checking both ports 139 and 445.

Best Practices

Start with -a. Capture output. Use authenticated queries when possible.

Related Tools

[SMBClient](/tools/smbclient) — Interactive share access

**smbmap**: Share enumeration with permissions

**CrackMapExec**: Active Directory tool

[Responder Guide](/articles/responder-guide)

[Nmap Beginner Tutorial](/articles/nmap-beginner-tutorial)

Summary

Enum4Linux automates SMB enumeration for users, shares, groups, and password policies on Windows/Samba systems.

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

What is a null session?

What does `-a` do?

How does Enum4Linux differ on modern vs legacy Windows?

What tool explores discovered shares manually?

Why is password policy useful?

Frequently Asked Questions

What is Enum4Linux?

Enum4Linux is a tool for enumerating Windows and Samba systems via SMB. It wraps Samba tools to gather users, shares, groups, policies, and security information from target machines.

What is a null session?

A null session is an unauthenticated connection to a Windows system's IPC$ share, allowing anonymous access to RPC services. Modern Windows systems disable null sessions by default, limiting this attack vector.

What does the -a flag do in Enum4Linux?

The `-a` flag runs all enumeration options: users, shares, groups, password policy, and system information. It provides a comprehensive scan of the target in a single command.

How does Enum4Linux differ on modern vs legacy Windows?

Legacy Windows (XP, Server 2003) allows null sessions for full enumeration. Modern Windows (7+, Server 2008+) blocks null sessions, requiring authenticated credentials (`-u` and `-p`) for most enumeration tasks.

What tool explores discovered shares manually?

[SMBClient](/tools/smbclient) connects to discovered shares for interactive browsing: `smbclient //target/share -U user`. It allows listing directories, downloading files, and uploading to accessible shares.

Why is password policy enumeration useful?

The `-P` flag reveals lockout thresholds, complexity requirements, and minimum length. This information helps craft targeted brute force attacks and assess password strength compliance.

How do you enumerate users without null sessions?

Use authenticated enumeration: `enum4linux -u admin -p password -a target`. Alternatively, try `enum4linux -U target` which uses SAMR RPC to list users even with limited access.

What ports does Enum4Linux check?

Enum4Linux checks SMB ports 139 and 445. Port 445 is preferred as it uses direct SMB over TCP without NetBIOS. Ensure both ports are accessible, as some systems only listen on one.