37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.2 NetBIOS and SMB Enumeration
Windows / Samba networks var NetBIOS (137/138/139) ani SMB (445) shares, workgroups, usernames leak karu shaktat – jar misconfigured asel.
Name lookup / null session concepts (lab):
# NetBIOS name query (Metasploitable often responds)
nmblookup -A 192.168.56.20
# List shares – try guest / no password carefully (lab only)
smbclient -L //192.168.56.20 -N
smbclient //192.168.56.20/tmp -N
enum4linux – classic one-shot SMB/NetBIOS enum wrapper (users, shares, OS info when allowed):
sudo apt install -y enum4linux
enum4linux -a 192.168.56.20
CrackMapExec / NetExec – modern SMB enum / auth testing framework. Concept: spray credentials, list shares, check signing. Deep AD abuse Chapter 38 madhe; ithe fakt idea:
# NetExec (nxc) – share list against lab host (no spray on real networks)
nxc smb 192.168.56.20 --shares
Null session: unauthenticated IPC$ connection – junya Windows/Samba setups madhe user/share lists yetat. Modern systems var band asayla hava.
Defence: SMBv1 disable kara; guest / anonymous shares band; require authentication (प्रमाणीकरण); firewall madhe 445/139 fakt trusted VLAN; SMB signing enable; patch Samba/Windows. Lakshat theva.
Ravindra Bagale's Tip
When smbclient -L fails, students say "the tool is broken". A failure is often a good sign – guest access is disabled. Enum success = misconfiguration. Defender mindset: if your lab's share list came out, run the same check on production and close it.
Ravindra Bagale's Tip – मराठी
smbclient -L fail झाले की students "tool खराब" म्हणतात. Fail होणे बऱ्याचदा चांगले लक्षण आहे – guest बंद आहे. Enum success = misconfig. Defender mindset: तुमच्या lab ची share list आली तर production वर तोच check करा आणि बंद करा.
Ravindra Bagale's Tip – हिंदी
smbclient -L fail हुआ तो students कहते हैं "tool खराब है". Fail होना अक्सर अच्छा संकेत है – guest बंद है. Enum success = misconfig. Defender mindset: आपकी lab की share list आ गई तो production पर वही check करो और बंद करो.
Lab
Metasploitable (192.168.56.20) var nmblookup -A, smbclient -L //192.168.56.20 -N ani enum4linux -a chalaa. Konti shares/users distat te note kara. Mag aaplya Amazon Linux Samba (jar asel) var guest share nahi he confirm kara – sudo service smb status (kiwa smbd).