SMB Enumeration (139/445)

Shares, users and signing over SMB.

Null session

List shares anonymously
netexec smb $IP -u '' -p '' --shares
smbclient -N -L //$IP
Guest vs null

Try both -u '' and -u 'guest'. Some hosts allow one and not the other.

RID brute force

Terminal window
netexec smb $IP -u guest -p '' --rid-brute

Techniques

Seen in writeups