SMB
SMB is the protocol behind Windows file and printer sharing — and Samba is its Linux counterpart. A misconfigured share or an anonymous RPC session can leak shares, users, and domain info before you’ve authenticated to anything, handing you the names you need to brute-force your way in.
Protocol: TCP · Port: 445 (CIFS) · legacy NetBIOS on 137/138/139
What Is SMB?
Server Message Block (SMB) is a client-server protocol that governs access to files, directories, and other network resources like printers and routers. A client uses it to access files or services shared on the network by an SMB server. Before any of that happens, both parties establish a connection — over IP networks SMB rides on TCP, using the three-way handshake before the session is set up. An SMB server can expose arbitrary parts of its local file system as shares. The hierarchy a client sees is therefore partly independent of the server’s real structure, and access is governed by Access Control Lists (ACLs).Samba and CIFS
Samba is the open-source SMB implementation for Linux. It implements CIFS (Common Internet File System), which is a specific “dialect” of SMB created by Microsoft — so Samba can talk to modern Windows systems. That’s why you’ll often see it written as SMB/CIFS. The ports tell you which generation you’re dealing with:Default Configuration
Samba is configured through/etc/samba/smb.conf. Filtered down, it has global settings (the server-wide configuration applied to all shares) and individual share definitions. Crucially, a share can override the global settings — and that’s exactly where misconfigurations creep in.
Dangerous Settings
Some Samba settings expose far more than the administrator intends. Ask, for each one: what convenience does it give an employee — and what does it hand an attacker who gets in?
A test share to see how these settings affect enumeration might look like:
smb.conf, the service has to be restarted (systemctl restart smbd) for changes to take effect. Administrators can review active connections with smbstatus, which shows the Samba version plus who is connected, from which host, and to which share.
Footprinting the Service
Nmap has plenty of SMB NSE scripts, but they can be slow and shallow — manual interaction usually surfaces far more. Start with a scan to confirm the service, then go manual.smbclient — Listing and Connecting to Shares
List the shares (a null/anonymous session needs no credentials):get to download interesting files. smbclient also lets you run local system commands with a leading ! without dropping the connection:
RPC Enumeration
When a share alone isn’t enough, rpcclient lets you perform MS-RPC functions against the server — passing parameters and reading back values. This is where anonymous access really leaks information.
A typical anonymous enumeration session:
RID Brute-Forcing
Sometimes most commands are blocked, butqueryuser <RID> still works by RID. You can brute-force the RID range to pull user info anyway. A Bash loop over rpcclient does the job:
Impacket samrdump.py
The same user enumeration is available through Impacket’ssamrdump.py:
Automated SMB Enumeration
Several tools wrap up the queries above.smbmap & netexec
smbmap shows shares and your access level on each; netexec (the successor to crackmapexec) does the same fast and across whole subnets:
enum4linux-ng
enum4linux-ng (a rewrite of the older enum4linux) automates a large portion of these queries in one shot — shares, users, groups, OS info, and password policy:
Quick Reference
The footprinting flow: nmap to confirm → smbclient to list/browse shares → rpcclient for users and domain info → RID brute-force if locked down → enum4linux-ng / netexec to automate and confirm.
Next: SMTP — user enumeration via VRFY/EXPN and open-relay testing.