Skip to content
📕 The Red Book

Samba with Linux

Enumeration

Section titled “Enumeration”

With nmap -sV we can do an educated guess if the server is using windows or linux

Terminal window
-
# TCP
nmap $IP -sV -p 139,445


# UDP
nmap $IP -sU --top-port 25 --open


# Via scripts
nmap $IP -p 445 --script smb-os-discovery

Metasploit way

Section titled “Metasploit way”

smb version

Section titled “smb version”
Terminal window
msfconsole
use auxiliary/scanner/smb/smb_version
set rhosts $IP
run

shares

Section titled “shares”
Terminal window
msfconsole
use auxiliary/scanner/smb/smb_enumshares
set rhosts $IP
run

nmblookup

Section titled “nmblookup”
Terminal window
nmblookup -A $IP

rpcclient

Section titled “rpcclient”
Terminal window
rpcclient -U "" -N $IP


srvinfo


enumdomusers


lookupnames admin

enum4linux

Section titled “enum4linux”
Terminal window
# get OS
enum4linux -o $IP


# get users
enum4linux -U $IP


# get sharelist
enum4linux -S $IP

# smbclient

Section titled “# smbclient”

To connect to smb shares

Terminal window
nmbclient -L $IP -N


nmbclient //$IP/Public -N