37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.2 NetBIOS and SMB Enumeration
Windows / Samba networks var NetBIOS (137/138/139) ani SMB (445) shares, workgroups, usernames leak karu shaktat – jar misconfigured asel.
Name lookup / null session concepts (lab):
# NetBIOS name query (Metasploitable often responds)
nmblookup -A 192.168.56.20
# List shares – try guest / no password carefully (lab only)
smbclient -L //192.168.56.20 -N
smbclient //192.168.56.20/tmp -N
enum4linux – classic one-shot SMB/NetBIOS enum wrapper (users, shares, OS info when allowed):
sudo apt install -y enum4linux
enum4linux -a 192.168.56.20
CrackMapExec / NetExec – modern SMB enum / auth testing framework. Concept: spray credentials, list shares, check signing. Deep AD abuse Chapter 38 madhe; ithe fakt idea:
# NetExec (nxc) – share list against lab host (no spray on real networks)
nxc smb 192.168.56.20 --shares
Null session: unauthenticated IPC$ connection – junya Windows/Samba setups madhe user/share lists yetat. Modern systems var band asayla hava.
Defence: SMBv1 disable kara; guest / anonymous shares band; require authentication (प्रमाणीकरण); firewall madhe 445/139 fakt trusted VLAN; SMB signing enable; patch Samba/Windows. Lakshat theva.
Ravindra Bagale's Tip
Students smbclient -L fail zala ki "tool kharab" mhantat. Fail often changla lakshan aahe – guest band aahe. Enum success = misconfig. Defender mindset: tumcha lab share list zala tar production var same check kara ani band kara.
Lab
Metasploitable (192.168.56.20) var nmblookup -A, smbclient -L //192.168.56.20 -N ani enum4linux -a chalaa. Konti shares/users distat te note kara. Mag aaplya Amazon Linux Samba (jar asel) var guest share nahi he confirm kara – sudo service smb status (kiwa smbd).