/smb-enumeration

name: smb-enumeration
description: >
  SMB share enumeration, access testing, password policy extraction, and
  content searching. Enumerates shares via null session, guest, and
  authenticated access. Covers share listing, per-share access testing,
  MANSPIDER content search, and SMB vulnerability detection (signing,
  EternalBlue). Use after network-recon identifies SMB ports (139/445).
keywords:
  - SMB shares
  - null session
  - guest access
  - smbclient
  - enum4linux
  - MANSPIDER
  - SMB signing
  - share enumeration
  - password policy
  - NetExec smb
tools:
  - smbclient
  - NetExec
  - enum4linux-ng
  - MANSPIDER
  - nmap
opsec: medium

SMB Enumeration

You are helping a penetration tester enumerate SMB services on a target host. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[smb-enumeration] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `smb-shares-10.10.10.5.txt`, `smb-manspider-results.txt`).

Scope Boundary

This skill covers SMB enumeration only — share listing, access testing, content searching, and vulnerability detection. When you reach the boundary of this scope, **STOP**.

Do not load or execute another skill. Return to the orchestrator with:

• What was found (shares, credentials, vulnerabilities)
• Recommended next skill
• Context to pass (DC IP, domain name, credentials, share paths)

**Routing boundaries:**

• RCE exploitation (EternalBlue, SMBGhost, PrintNightmare)
• Domain enumeration (LDAP, BloodHound, GPP)
• Password brute forcing or spraying
• Writable share abuse (web shells, DLL hijack)

**Stay in methodology.** Only use techniques documented in this skill.

What This Skill Does NOT Do

• Exploit SMB vulnerabilities (EternalBlue, SMBGhost, PrintNightmare)
• Perform password spraying or brute force attacks
• Run Active Directory enumeration (LDAP queries, BloodHound)
• Abuse writable shares for code execution or relay NTLM authentication

These are handled by dedicated skills. This skill discovers and reports.

State Management

Call `get_state_summary()` to read current engagement state. Use it to:

• Skip re-testing targets already enumerated for SMB
• Leverage existing credentials for authenticated enumeration (Step 7)
• Check what's been tried and failed (Blocked section)

**State writes** — write critical discoveries immediately:

• SMB signing disabled → `add_vuln(title="SMB signing disabled on <host>", host="<host>", vuln_type="smb-signing", severity="medium")`
• Null session or guest access → `add_vuln(title="SMB null/guest access on <host>", host="<host>", vuln_type="null-session", severity="medium")`
• EternalBlue confirmed → `add_vuln(title="MS17-010 EternalBlue on <host>", host="<host>", vuln_type="rce", severity="critical")`
• Domain name/hostnames from SMB → `add_pivot(source="SMB on <host>", destination="<domain>/<hostname>", method="SMB OS discovery")`
• Credentials found in share files → `add_credential(username="<user>", secret="<password>", secret_type="password", source="SMB share file <path>")`

**Return summary must include:**

• Per-share access table (mandatory — every share gets a row)
• Account lockout policy (if enumerable)
• Domain/hostname info discovered
• Credentials found
• Vulnerabilities confirmed (signing, null session, EternalBlue)

Prerequisites

• Network access to SMB ports (139/445) on target
• Target IP address (provided by orchestrator or operator)
• Optional: credentials for authenticated enumeration (passed by orchestrator)

Step 1: Share Listing

**Run ALL of the following tools in sequence — not just one.** SMB tools use different RPC calls and authentication methods under the hood. A failure or partial result from one tool does NOT mean the others will also fail. NetExec might return `STATUS_USER_SESSION_DELETED` while `smbclient -L` succeeds, or vice versa. You must try every tool before concluding that SMB enumeration has failed.

# Tool 1: smbclient null session share listing
smbclient -N -L //TARGET_IP/

# Tool 2: NetExec null session + guest
netexec smb TARGET_IP -u '' -p '' --shares
netexec smb TARGET_IP -u 'guest' -p '' --shares

# Tool 3: enum4linux-ng comprehensive enumeration
enum4linux-ng -A TARGET_IP

Collect all unique share names from ALL tools. A share discovered by any tool counts — even if other tools failed to list it.

Step 2: Password/Lockout Policy

netexec smb TARGET_IP -u '' -p '' --pass-pol
netexec smb TARGET_IP -u 'guest' -p '' --pass-pol

If either succeeds, record the full policy. The orchestrator needs this before routing to password-spraying. Key values: lockout threshold (0 = no lockout — critical for spray decisions), observation window, lockout duration, min password length, complexity requirements.

Step 3: User and Vulnerability Enumeration via NSE

nmap -sV -p445 --script smb-enum-shares,smb-enum-users,smb-os-discovery,smb-vuln* TARGET_IP

Check results for: SMB signing status, OS version, EternalBlue (ms17-010), SMBGhost (CVE-2020-0796), user accounts enumerated.

Step 4: Per-Share Access Testing (MANDATORY)

**This step is NOT optional.** Test every share individually with `smbclient`. Access denied on one share tells you NOTHING about other shares — Windows ACLs are per-share. Skipping a share is a methodology failure.

For EVERY share discovered in Steps 1 and 3 (from ANY tool), run:

smbclient //TARGET_IP/SHARENAME -N -c 'ls' 2>&1

If `ls` succeeds (shows files/directories), the share is readable. Follow up:

# Recursive listing of accessible share
smbclient //TARGET_IP/SHARENAME -N -c 'recurse ON; prompt OFF; ls'

# Download interesting files (configs, scripts, credentials, backups)
smbclient //TARGET_IP/SHARENAME -N -c 'rec