enum4linux — SMB Enumeration Reference
What is enum4linux?
enum4linux is a Linux tool for extracting information from Windows and Samba systems via SMB and RPC. It wraps smbclient, rpcclient, net, and nmblookup into a single automated run.
enum4linux-ng is the modern rewrite — faster, cleaner output, JSON/YAML export, better null session handling.
OSCP use: Run
enum4linux -aas a standard step whenever you find port 139 or 445 open. It gives you users, groups, shares, password policy, and OS info in one shot — even without credentials.
Install (Kali)
sudo apt update && sudo apt install -y enum4linux-ng
# legacy: sudo apt install enum4linuxVerify: enum4linux-ng -h
Full install index → Installation - Kali Setup
Syntax
enum4linux [options] TARGET
enum4linux-ng [options] TARGET📌 1) enum4linux Flags
| Flag | Description |
|---|---|
-a | All — run all enumeration checks (recommended starting point) |
-U | Enumerate users via RPC |
-G | Enumerate groups |
-S | Enumerate shares |
-P | Enumerate password policy |
-o | Enumerate OS information |
-n | NetBIOS name info (nmblookup) |
-i | Printer information |
-r | Enumerate users via RID cycling (even without readable user list) |
-R <range> | RID range for cycling (default: 500-550, 1000-1050) |
-l | Enumerate via LDAP (port 389) |
-s <file> | Brute-force share names from a file |
-k <user> | Specify user for Kerberos auth |
-u <user> | Username for authenticated enumeration |
-p <pass> | Password |
-d | Detailed share info |
-v | Verbose output |
-w <domain> | Set workgroup/domain |
📌 2) enum4linux Examples
Full anonymous enumeration (standard first run)
enum4linux -a 10.10.10.10Authenticated full enumeration
enum4linux -a -u admin -p password 10.10.10.10Only enumerate users
enum4linux -U 10.10.10.10Only enumerate shares
enum4linux -S 10.10.10.10RID cycling — find users even when user list is locked
enum4linux -r 10.10.10.10
enum4linux -r -R 500-1500 10.10.10.10 # Wider RID rangePassword policy (important before brute-forcing)
enum4linux -P 10.10.10.10Save full output to file
enum4linux -a 10.10.10.10 | tee enum4linux_10.10.10.10.txt📌 3) enum4linux-ng Flags
The -ng version uses different flags but covers the same ground with better output:
| Flag | Description |
|---|---|
-A | All checks (equivalent to -a in original) |
-U | Enumerate users |
-G | Enumerate groups |
-Sp | Enumerate shares with permissions |
-P | Password policy |
-O | OS information |
-L | LDAP queries |
-I | NetBIOS/nmblookup |
-u <user> | Username |
-p <pass> | Password |
-d <domain> | Domain |
-oJ <file> | Output JSON |
-oY <file> | Output YAML |
-oA <file> | Output both JSON and YAML |
--dc-ip <ip> | Specify Domain Controller IP |
--timeout <sec> | Connection timeout |
-v | Verbose |
📌 4) enum4linux-ng Examples
Full anonymous enumeration
enum4linux-ng 10.10.10.10 -A
Authenticated
enum4linux-ng 10.10.10.10 -A -u admin -p password
Save to JSON (great for notes/reporting)
enum4linux-ng 10.10.10.10 -A -oJ enum_results
# Creates: enum_results.jsonSave everything
enum4linux-ng 10.10.10.10 -A -oA enum_results📌 5) What to Look For in Output
Users section
[+] Found user: Administrator (RID 500)
[+] Found user: bob (RID 1001)
[+] Found user: alice (RID 1002)
Take note of all usernames — feed them into Hydra or CrackMapExec - nxc for password attacks.
Shares section
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
Backups Disk Company Backups
Note any non-default shares — connect with smbclient or smbmap.
Password policy section
[+] Minimum password length: 5
[+] Password history length: 0
[+] Maximum password age: 37 days
[+] Account lockout threshold: None
[+] Account lockout duration: 30 mins
Lockout threshold: None = safe to brute-force without locking accounts.
OS info section
[+] OS: Windows 7 (6.1)
[+] OS version: '6.1'
[+] OS Release: '7601'
[+] OS build: '7601.win7sp1_rtm'
Tells you the exact OS — useful for selecting exploits.
📌 Quick OSCP Cheat Sheet (Copy/Paste)
# Standard first run (null session)
enum4linux -a 10.10.10.10 | tee enum_TARGET.txt
# With credentials
enum4linux -a -u username -p password 10.10.10.10
# RID cycling for users
enum4linux -r -R 500-1200 10.10.10.10
# ng version — full + JSON output
enum4linux-ng 10.10.10.10 -A -oJ enum_TARGET