Enumeration

Enumeration via SMB

Enumeration on NetExec

Host Enumeration (Returns a list of live hosts)

nxc smb 192.168.1.0/24 

Null Sessions

Checking if Null Session is enabled on the network, can be very useful on a Domain Controller to enumerate users, groups, password policy etc

nxc smb 10.10.10.161 -u '' -p ''

nxc smb 10.10.10.161 -u '' -p '' --shares (Shares enumeration)

nxc smb 10.10.10.161 -u '' -p '' --pass-pol (Password policy enumeration)

nxc smb 10.10.10.161 -u '' -p '' --users (User enumeration)

nxc smb 10.10.10.161 -u '' -p '' --groups (Group enumeration)

You can also reproduce this behavior with smbclient or rpcclient

smbclient -N -U "" -L \\10.10.10.161

rpcclient -N -U "" -L \\10.10.10.161

rpcclient $> enumdomusers

user:[bonclay] rid:[0x46e]

user:[zoro] rid:[0x46f]

Anonymous Logon

Using a random username and password you can check if the target accepts annonymous/guest logon

nxc smb 10.10.10.178 -u 'a' -p ''

You can also check this behavior with smbclient or rpcclient

smbclient -N -L \\10.10.10.178

rpcclient -N -L 10.10.10.178

Host Enumeration with SMB signing not required

Maps the network of live hosts and saves a list of only the hosts that don't require SMB signing. List format is one IP per line

nxc smb 192.168.1.0/24 --gen-relay-list relay_list.txt

Alternative with nmap

nmap --script smb-security-mode.nse,smb2-security-mode.nse -p445 127.0.0.1

Active Sessions

Enumerate active sessions on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sessions

Shares and Access enumeration

Enumerate permissions on all shares

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares

If you want to filter only by readable or writable share

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares --filter-shares READ WRITE

Disk Enumeration

Enumerate disks on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --disks

Logged on Users Enumeration

Enumerate logged users on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-users

Domain Users Enumeration

Enumerate domain users on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --users

RID Bruteforce

Enumerate users by bruteforcing the RID on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute

Domain Groups Enumeration

Enumerate domain groups on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --groups

Local Groups Enumeration

Enumerate local groups on the remote target

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --local-group

Domain Password Policy Enumeration

Using the option --pass-pol you can get the password policy of the domain

nxc smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol

Anti-Virus & EDR Enumeration

Enumerate antivirus installed using NetExec

You don't need to be a privileged user to do this action

nxc smb <ip> -u user -p pass -M enum_av