enum4linux

A Perl (and later Python) tool for enumerating information from Windows and Samba systems over SMB — the Linux-friendly equivalent of the Windows enum.exe. Originally written by Mark Lowe (Portcullis Labs, later Cisco CX Security); a maintained Python rewrite exists as enum4linux-ng. ¹

Basic usage

enum4linux -a $TARGET_IP

-a runs the full simple enumeration: users, shares, groups, password policy, OS information, and RID cycling.

RID cycling

The most reliable user-enumeration primitive. Windows SIDs for local and domain accounts are built from a base SID plus a Relative Identifier (RID) — a small integer starting at well-known values (500 = Administrator, 501 = Guest, then 1000+ for normal users). enum4linux walks the RID space and asks the server to resolve each SID to a name via the LSARPC named pipe, revealing valid accounts even when direct user-list queries fail.

• -r — enumerate users via RID cycling only
• -R ridrange — custom range (default 500-550,1000-1050)
• -U — quick user list via QueryUserList (broken against many modern targets; prefer -r)

Operational notes

• Works against both Windows hosts and UNIX-like systems running Samba
• Requires at least a null session or valid credentials
• Share enumeration overlaps with smbclient (-L) and smbmap; enum4linux’s strength is user/group/policy extraction
• Discovered usernames feed directly into password-spraying and AS-REP roasting attacks
• Samba field note: against Samba targets, -U (quick user list) frequently errors out; running enum4linux with no flags (full -a-style enumeration) still succeeds — the SID-guessing/RID brute-force phase runs after the failing query, and the error is non-fatal (enumeration continues past it). Don’t abort on the first error message.

Sources

• enum4linux
• enum4linux-ng
• Account Discovery

Related: smbclient, smbmap, default-cifs-shares, windows-reconnaissance-commands, nbtscan

Footnotes

1. enum4linux ↩