Enum4linux: SMB Enumeration for Pentesters

When you come across an SMB service on a target, enum4linux is one of your go-to tools for fast and detailed enumeration. It’s basically a wrapper around smbclient, rpcclient, net, and nmblookup, automating the dirty work of probing Windows shares and services.

This post will cover:

• What enum4linux is
• When to use it
• Command breakdowns
• Real-world tips and usage examples

What is enum4linux?

enum4linux is a Linux-based enumeration script designed for gathering information from Windows hosts using SMB. It pulls info like:

• Usernames
• Group memberships
• Shares
• OS details
• Password policy
• RID cycling (for brute-forcing users)

It’s especially useful when targeting older Windows systems or misconfigured domain members.

When Should You Use Enum4linux?

Use it right after discovering an SMB port (445 or 139) on a target. It’s great for unauthenticated recon or when you have low-priv credentials.

Common scenarios:

• CTFs and labs (e.g. OSCP, TryHackMe, HackTheBox)
• Enumerating Windows file servers
• Testing for misconfigured access permissions

Basic Usage

enum4linux <target-ip>
# Run all default checks against the target

This performs:

• OS detection
• Share enumeration
• User listing
• Password policy dump
• RID brute force

Useful Flags

enum4linux -U <target-ip>
# Enumerate users

enum4linux -S <target-ip>
# Enumerate shares

enum4linux -P <target-ip>
# Enumerate password policy

enum4linux -G <target-ip>
# Enumerate groups

enum4linux -r <target-ip>
# List shared resources (using 'smbclient -L')

enum4linux -a <target-ip>
# Run ALL checks (same as default behavior)

You can combine flags as needed. Example:

enum4linux -U -S -P -r <target-ip>
# Targeted enumeration

Sample Output Breakdown

What you’re looking for:

• Users you can try in bruteforce or Kerberos attacks
• Shares you might be able to access (e.g. netlogon, sysvol, backup, users)
• Group info that shows who’s in what (e.g. if bob is in Domain Admins)
• Password policy (useful for timing attacks and password spraying)
• OS version (helps identify exploits or SMB signing status)

Limitations

• It’s old and noisy — expect blue team alerts in real networks
• Doesn’t work well on hardened systems (e.g. with SMBv1 disabled)
• Can break or give incomplete output on newer Windows Server versions
• It’s passive — no exploitation functionality, just recon

Real-World Pentest Tip

If enum4linux isn’t giving you much (or fails), try these alternatives:

smbclient -L //<target-ip> -N
# List shares anonymously

rpcclient -U "" <target-ip>
# Drop into a shell to interact with the RPC service

crackmapexec smb <target-ip> --shares
# More modern and flexible enumeration

Final Thoughts

enum4linux may be old, but it still has value in initial SMB recon — especially in labs or lightly defended environments. For real engagements, pair it with tools like CrackMapExec, rpcclient, and smbclient for deeper insight and stealthier testing.