E-ENU
enum4linux-ng
Modernized rewrite of enum4linux for enumerating SMB/RPC shares, users, groups, and password policy on Windows/Samba hosts.
OVERVIEW
enum4linux-ng (cddmp/enum4linux-ng) is a Python rewrite of the classic Perl enum4linux, itself a wrapper around Samba's rpcclient, smbclient, and net tools. Pointed at a Windows or Samba host, it pulls OS information, domain/workgroup membership, users, groups, shares, and the password policy in one pass, and can emit the result as structured JSON/YAML for tooling downstream.
It keeps enum4linux's original flag layout for anyone used to the classic tool, while fixing long-standing bugs, adding IPv6 support, and improving output for both anonymous (null-session) and credentialed enumeration.
USE CASES
Practical use cases
- 01
Confirming whether anonymous (null-session) SMB access is possible on a Windows/Samba host.
- 02
Enumerating shares, users, groups, and password policy in one pass instead of chaining rpcclient calls by hand.
- 03
Fingerprinting the OS and domain/workgroup membership of a newly discovered SMB host.
- 04
Feeding discovered usernames and policy details into a later password-spraying or share-access review.
QUICK START
Once a Windows or Samba host with SMB open is identified, to pull shares, users, groups, and password policy before deciding on credentialed access.
- Confirm SMB (TCP 139/445) enumeration against this host is within the agreed scope.
- Install enum4linux-ng (pip install or git clone) and its Samba-tools dependency.
- Run it with -A against the target to get all default checks in one pass.
- Try again with a low-privilege credential if anonymous access is refused, only if credentials are in scope.
- Review the shares, users, and password policy output for follow-up leads.
./enum4linux-ng.py -A 10.10.10.10BEFORE YOU RUN IT
What to check before running it
Anonymous (null-session) SMB access is disabled by default on modern Windows and hardened Samba builds, so a clean result there is expected, not a bug.
It only reports what the target actually exposes over SMB/RPC; a locked-down host can legitimately return almost nothing.
Enumeration traffic against SMB/RPC is logged by most EDR and can trip account lockout if run with invalid credentials repeatedly — confirm the lockout threshold before retrying with guesses.