# Enum4linux

> Auth/lab ref: enum4linux SMB/Samba enumeration; users, shares, groups, OS info, password policy, null-session evidence.

- Skill: `aeondave/enum4linux` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/enum4linux`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/enum4linux/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-2.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/enum4linux

---


# enum4linux

SMB enumeration tool — extracts users, shares, groups, and domain info from Windows/Samba hosts.

## Quick Start

```bash
# Full enumeration (null session)
enum4linux -a 192.168.1.10

# With credentials
enum4linux -a -u admin -p password 192.168.1.10

# Modern rewrite (enum4linux-ng recommended)
enum4linux-ng -A 192.168.1.10
```

## Flags (Classic)

| Flag | Description |
|------|-------------|
| `-a` | All: runs `-U -S -G -P -r -o -n -i` |
| `-U` | User list via RPC |
| `-M` | Machine list |
| `-S` | Share enumeration |
| `-P` | Password policy |
| `-G` | Group enumeration |
| `-r` | User list via RID cycling |
| `-R <range>` | RID range (default `500-550,1000-1050`) |
| `-u <user>` | Username for auth |
| `-p <pass>` | Password for auth |
| `-d` | Debug mode |
| `-v` | Verbose |
| `-o` | Get OS information |
| `-i` | Printer info |
| `-n` | Nmblookup info |

## enum4linux-ng Flags (Recommended)

| Flag | Description |
|------|-------------|
| `-A` | All checks |
| `-u <user>` | Username |
| `-p <pass>` | Password |
| `-oJ <file>` | JSON output |
| `-oY <file>` | YAML output |
| `-t <n>` | Timeout |
| `--no-color` | Disable color output |

## Common Workflows

```bash
# Full null session enum (no creds)
enum4linux -a 10.10.10.100

# Authenticated full enum
enum4linux -a -u "DOMAIN\user" -p "password" 10.10.10.100

# RID cycling for user enumeration
enum4linux -r -R 500-2000 10.10.10.100

# Modern approach with JSON output
enum4linux-ng -A 10.10.10.100 -oJ output.json

# Share enumeration only
enum4linux -S 10.10.10.100

# Password policy extraction
enum4linux -P 10.10.10.100
```

## Key Info Extracted

- Domain/workgroup name and OS version
- User accounts (via RPC and RID brute-force)
- Shares (writable/readable)
- Group memberships
- Password policy (lockout threshold, complexity)
- Printer and session info

## Resources

| File | When to load |
|------|--------------|
| `references/smb-enumeration.md` | SMB enumeration techniques, smbclient commands, null session exploitation |