Windows Enumeration with `enum4linux`

Published on January 18, 2025

`enum4linux` is a powerful and widely used tool for enumerating information from Windows hosts via SMB. This guide demonstrates how to use it effectively in various scenarios to gather critical information during penetration testing or network assessments.

1. Basic Host Enumeration

Retrieve general information about a Windows host.

enum4linux <target-ip>

Example:

enum4linux 192.168.1.10

Output:

  • OS version and hostname
  • Domain information
  • Shares available

2. Detailed Verbose Output

Use the -v option to increase verbosity.

enum4linux -v <target-ip>

Example:

enum4linux -v 192.168.1.10

3. Enumerate Users

Fetch user accounts from the target machine.

enum4linux -u <target-ip>

Example:

enum4linux -u 192.168.1.10

4. List Shares

Display shared resources on the target.

enum4linux -S <target-ip>

Example:

enum4linux -S 192.168.1.10

Output:

  • Administrative and user-created shares

5. Brute-Force User Enumeration

Perform brute-force enumeration of usernames.

enum4linux -U <target-ip>

Example:

enum4linux -U 192.168.1.10

6. Domain Group Enumeration

List domain groups and their members.

enum4linux -G <target-ip>

Example:

enum4linux -G 192.168.1.10

7. Retrieve Password Policies

Enumerate password policies like lockout thresholds and expiration periods.

enum4linux -P <target-ip>

Example:

enum4linux -P 192.168.1.10

8. All Enumeration Options

Use the -a flag to perform all enumeration tasks.

enum4linux -a <target-ip>

Example:

enum4linux -a 192.168.1.10

9. Use Credentials

Authenticate with a username and password for more detailed enumeration.

enum4linux -u <username> -p <password> <target-ip>

Example:

enum4linux -u admin -p pass123 192.168.1.10

10. Save Output to a File

Redirect the output to a file for later analysis.

enum4linux <target-ip> > output.txt

Example:

enum4linux -a 192.168.1.10 > enum_results.txt

Tips for Effective Use

  • Ensure Legal Use: Only scan systems you have permission to test.
  • Use With Nmap: Combine enum4linux with an Nmap scan for a comprehensive assessment.
  • Target SMB Ports: Ensure SMB ports (139, 445) are open on the target.

By mastering enum4linux, you can gather critical information to aid in penetration testing and network diagnostics. Use it responsibly and always adhere to ethical guidelines.

Linked Articles