【オプション一覧つき】enum4linux-ng（次世代のSMB列挙ツール）を徹底解説！

$ enum4linux-ng [オプション] <ターゲットホスト>

$ enum4linux-ng 192.0.2.1

# 匿名接続（NULLセッション）
$ enum4linux-ng 192.0.2.1

# 認証情報を使った接続
$ enum4linux-ng -u <ユーザー名> -p <パスワード> 192.0.2.1

# YAML形式で出力
$ enum4linux-ng -oY ./result 192.0.2.1

# JSON形式で出力
$ enum4linux-ng -oJ ./result 192.0.2.1

# JSONとYAMLで両方を出力
$ enum4linux-ng -oA ./result 192.0.2.1

$ enum4linux-ng -h
ENUM4LINUX - next generation (v1.3.10)

usage: enum4linux-ng [-h] [-A] [-As] [-U] [-G] [-Gm] [-S] [-C] [-P] [-O] [-L] [-I] [-R [BULK_SIZE]] [-N] [-w DOMAIN] [-u USER] [-p PW |
                     -K TICKET_FILE | -H NTHASH] [--local-auth] [-d] [-k USERS] [-r RANGES] [-s SHARES_FILE] [-t TIMEOUT] [-v] [--keep]
                     [-oJ OUT_JSON_FILE | -oY OUT_YAML_FILE | -oA OUT_FILE]
                     host

This tool is a rewrite of Mark Lowe's enum4linux.pl, a tool for enumerating information from Windows and Samba systems.
It is mainly a wrapper around the Samba tools nmblookup, net, rpcclient and smbclient.
Other than the original tool it allows to export enumeration results as YAML or JSON file, so that it can be further processed with other tools.
The tool tries to do a 'smart' enumeration.
It first checks whether SMB or LDAP is accessible on the target.
Depending on the result of this check, it will dynamically skip checks (e.g. LDAP checks if LDAP is not running).
If SMB is accessible, it will always check whether a session can be set up or not.
If no session can be set up, the tool will stop enumeration.
The enumeration process can be interupted with CTRL+C.
If the options -oJ or -oY are provided, the tool will write out the current enumeration state to the JSON or YAML file, once it receives SIGINT triggered by CTRL+C.
The tool was made for security professionals and CTF players.
Illegal use is prohibited.

positional arguments:
  host

options:
  -h, --help         show this help message and exit
  -A                 Do all simple enumeration including nmblookup (-U -G -S -P -O -N -I -L). This option is enabled if you don't provide any other option.
  -As                Do all simple short enumeration without NetBIOS names lookup (-U -G -S -P -O -I -L)
  -U                 Get users via RPC
  -G                 Get groups via RPC
  -Gm                Get groups with group members via RPC
  -S                 Get shares via RPC
  -C                 Get services via RPC
  -P                 Get password policy information via RPC
  -O                 Get OS information via RPC
  -L                 Get additional domain info via LDAP/LDAPS (for DCs only)
  -I                 Get printer information via RPC
  -R [BULK_SIZE]     Enumerate users via RID cycling. Optionally specify the lookup request size (BULK_SIZE).
  -N                 Do an NetBIOS names lookup (similar to nbtstat) and try to retrieve workgroup from output
  -w DOMAIN          Specify workgroup/domain manually (usually found automatically)
  -u USER            Specify username to use (default "")
  -p PW              Specify password to use (default "")
  -K TICKET_FILE     Try to authenticate with Kerberos, only useful in Active Directory environment (Note: DNS must be setup correctly for this option to work
  -H NTHASH          Try to authenticate with hash
  --local-auth       Authenticate locally to target
  -d                 Get detailed information for users and groups, applies to -U, -G and -R
  -k USERS           User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none). Used to get sid with "lookupsids"
  -r RANGES          RID ranges to enumerate (default: 500-550,1000-1050)
  -s SHARES_FILE     Brute force guessing for shares
  -t TIMEOUT         Sets connection timeout in seconds (default: 10s)
  -v                 Verbose, show full samba tools commands being run (net, rpcclient, etc.)
  --keep             Don't delete the Samba configuration file created during tool run after enumeration (useful with -v)
  -oJ OUT_JSON_FILE  Writes output to JSON file (extension is added automatically)
  -oY OUT_YAML_FILE  Writes output to YAML file (extension is added automatically)
  -oA OUT_FILE       Writes output to YAML and JSON file (extensions are added automatically)

$ enum4linux-ng -S 192.168.10.101
ENUM4LINUX - next generation (v1.3.10)

 ==========================
|    Target Information    |
 ==========================
[*] Target ........... 192.168.10.101
[*] Username ......... ''
[*] Random Username .. 'ndstgwav'
[*] Password ......... ''
[*] Timeout .......... 10 second(s)

 =======================================
|    Listener Scan on 192.168.10.101    |
 =======================================
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp

 ===========================================
|    SMB Dialect Check on 192.168.10.101    |
 ===========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: true
  SMB 2.0.2: false
  SMB 2.1: false
  SMB 3.0: false
  SMB 3.1.1: false
Preferred dialect: SMB 1.0
SMB1 only: true
SMB signing required: false
[*] Enforcing legacy SMBv1 for further enumeration

 =============================================================
|    Domain Information via SMB session for 192.168.10.101    |
 =============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: METASPLOITABLE
NetBIOS domain name: ''
DNS domain: localdomain
FQDN: metasploitable.localdomain
Derived membership: workgroup member
Derived domain: unknown

 ===========================================
|    RPC Session Check on 192.168.10.101    |
 ===========================================
[*] Check for anonymous access (null session)
[+] Server allows authentication via username '' and password ''
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE

 =====================================================
|    Domain Information via RPC for 192.168.10.101    |
 =====================================================
[+] Domain: WORKGROUP
[+] Domain SID: NULL SID
[+] Membership: workgroup member

 ========================================
|    Shares via RPC on 192.168.10.101    |
 ========================================
[*] Enumerating shares
[+] Found 5 share(s):
ADMIN$:
  comment: IPC Service (metasploitable server (Samba 3.0.20-Debian))
  type: IPC
IPC$:
  comment: IPC Service (metasploitable server (Samba 3.0.20-Debian))
  type: IPC
opt:
  comment: ''
  type: Disk
print$:
  comment: Printer Drivers
  type: Disk
tmp:
  comment: oh noes!
  type: Disk
[*] Testing share ADMIN$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share IPC$
[+] Mapping: OK, Listing: NOT SUPPORTED
[*] Testing share opt
[+] Mapping: DENIED, Listing: N/A
[*] Testing share print$
[+] Mapping: DENIED, Listing: N/A
[*] Testing share tmp
[+] Mapping: OK, Listing: OK

Completed after 0.51 seconds