Skip to content
Home

enum4linux: Windows/Samba enumeration

Pull OS info, users, shares, groups and password policy from an SMB host on a single run.

bash·1 min read··INE Certification

enum4linux wraps net, rpcclient, nmblookup and others into one command, so it’s usually the fastest way to get a broad first read on an SMB target before going tool-by-tool.

Common runs

enum4linux -o <target_ip>                       # OS info, no creds needed
enum4linux -a <target_ip>                       # everything at once (-U -S -G -r -o -n)
enum4linux -U <target_ip>                       # users only
enum4linux -S <target_ip>                       # shares only
enum4linux -u "username" -p "password" -S <target_ip>   # authenticated share listing

Single-purpose flags

FlagEnumerates
-UUsers
-SShares
-GGroups
-PPassword policy
-LLSA policy
-rRID cycling for user enumeration
-R <range>RID range to cycle (default 500-550,1000-1050)

Tips

  • Credentials need to be quoted (-u "administrator") even for a single word.
  • With no usernames yet, try enum4linux’s own built-in guesses manually too: administrator, guest, krbtgt, domain admins, root.
  • Against a Samba box specifically, also try root, nobody, sys.