Skip to content
HackIndex logo

HackIndex

SMB Null Session Enumeration

4 min read Jul 14, 2026

A null session authenticates to SMB with empty credentials. On older Windows systems, misconfigured hosts, and Samba installations with map to guest = bad user, null sessions allow unauthenticated enumeration of shares, users, groups, and password policy. Modern Windows defaults block null sessions, but they still appear regularly on internal networks and lab targets.

Quick Null Session Check with nxc

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u '' -p '' 
SMB   10.10.10.5  445  LEGACY01  [+] WORKGROUP\: (Guest)

A [+] result confirms null or guest session access. Move immediately to shares, users, and password policy:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u '' -p '' --shares
nxc smb $TARGET_IP -u '' -p '' --users
nxc smb $TARGET_IP -u '' -p '' --groups
nxc smb $TARGET_IP -u '' -p '' --pass-pol

--pass-pol returns the lockout threshold and minimum password length, which feeds directly into spray timing decisions — see AD Password Policy and Spray Surface. --users gives you a SAM account list without any credentials — feed it into AD Password Spraying or AS-REP Roastable Account Enumeration.

Also test the guest account explicitly:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u 'guest' -p '' --shares

enum4linux-ng

enum4linux-ng runs a comprehensive null session sweep covering shares, users, groups, password policy, OS info, and RPC enumeration in a single command:

┌──(kali㉿kali)-[~]
└─$ enum4linux-ng -A $TARGET_IP

With explicit null credentials:

┌──(kali㉿kali)-[~]
└─$ enum4linux-ng -A -u '' -p '' $TARGET_IP

Key output sections to read:

  • [+] Shares — all shares and access level

  • [+] Users — SAM user dump via RPC

  • [+] Groups — local and domain group membership

  • [+] Password Policy — complexity, lockout settings

  • [+] OS Information — hostname, domain, OS version

┌──(kali㉿kali)-[~]
└─$ enum4linux -a $TARGET_IP

smbclient Null Session

Confirm null session and list shares:

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -N 
Sharename       Type      Comment
        ---------       ----      -------
        IPC$            IPC       IPC Service (Samba 4.6.2)
        backup          Disk

Connect to IPC$ to confirm null bind works at the protocol level:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/IPC$ -N

A successful connection confirms the null session is active. Connect to any readable share:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/$SHARE -N

rpcclient Null Session

rpcclient uses the null session to enumerate users, groups, and domain information via named pipe calls over IPC$:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP

Key commands inside the session:

srvinfo          server info and OS version
enumdomusers     all domain user accounts with RIDs
enumdomgroups    domain groups
querydominfo     domain name, user count, policy values
getdompwinfo     password policy
netshareenumall  all shares including hidden

Non-interactive one-liners:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP -c 'enumdomusers'
┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP -c 'querydominfo'
┌──(kali㉿kali)-[~]
└─$ rpcclient -U '' -N $TARGET_IP -c 'netshareenumall'

Try guest if null is blocked:

┌──(kali㉿kali)-[~]
└─$ rpcclient -U 'guest%' $TARGET_IP -c 'enumdomusers'

Nmap Null Session Scripts

OS, hostname, and domain via SMB without credentials:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script smb-os-discovery $TARGET_IP 
| smb-os-discovery:
|   OS: Windows 7 Ultimate 7601 Service Pack 1
|   Computer name: LEGACY01
|   NetBIOS computer name: LEGACY01
|   Domain name: WORKGROUP
|   System time: 2025-03-10T10:23:14+00:00

Share and user enumeration via Nmap:

┌──(kali㉿kali)-[~]
└─$ nmap -p 139,445 --script smb-enum-shares,smb-enum-users $TARGET_IP

smbmap Anonymous Check

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP 
[+] IP: 10.10.10.5:445   Name: legacy01
        Disk             Permissions     Comment
        ----             -----------     -------
        backup           READ ONLY
        IPC$             NO ACCESS

Recursive listing of a readable share:

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -r $SHARE

Interpreting Results

A null session returning shares confirms the host allows unauthenticated SMB access. Any READ permission on a non-IPC share means file browsing is possible without credentials. User lists from enumdomusers or --users map the account surface. Password policy from --pass-pol or getdompwinfo determines safe spray timing.

On modern Windows hosts with null sessions blocked, every attempt returns STATUS_ACCESS_DENIED or STATUS_LOGON_FAILURE. Move to authenticated enumeration if null session is not available.

References