Academy Node
SMB Enumeration
SMB enumeration checks shares, permissions, signing, sessions, and whether credentials work against Windows hosts.
Beginner100 XPEnumeration
Why it matters
SMB is usually the first real AD foothold source: usernames, files, passwords, shares, and local admin checks.
How to identify it
- Port 445 open
- Anonymous or credentialed SMB access
- Readable shares or IPC access
BloodHound indicators
- Sessions
- AdminTo
- File shares manually mapped from loot
NetExec commands
nxc smb 192.168.184.0/24nxc smb 192.168.184.141 -u '' -p '' --sharesnxc smb 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --sharesImpacket commands
smbclient -L //192.168.184.141 -Nsmbclient //192.168.184.141/SHARE -U 'xutslabs.local/ba_low%Password123'Linux commands
smbmap -H 192.168.184.141 -u ba_low -p 'Password123' -d xutslabs.localExpected output
- Share listing
- READ/WRITE permissions
- Pwn3d! means local admin in NetExec
Success looks like
- Find readable shares
- Find files with creds
- Validate user has admin access
Failure looks like
- STATUS_ACCESS_DENIED
- No shares beyond IPC$
Troubleshooting
- Try hostname and IP
- Add DC to /etc/hosts
- Try domain and local auth formats
Common mistakes
- Only checking anonymous SMB
- Not recursively downloading readable shares
- Ignoring WRITE access
Alternative attacks
- LDAP enumeration
- RPC enumeration
- Password spraying
What to try next
- Download readable shares
- Search for passwords
- Validate found creds
- Run BloodHound if creds work
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.