Skip to content
HackIndex logo

HackIndex

Weak Password Policy via SMB

2 min read May 15, 2026

Password policy exposure is already covered in your null-session enumeration page, but weak password policy itself deserves its own vulnerability discovery page because it tells you whether the environment tolerates poor passwords and whether lockout pressure is low enough that password attacks become more realistic. rpcclient supports domain password policy queries, and HackIndex already notes that null sessions can sometimes leak password policy data.

Start with the direct RPC check.

┌──(kali㉿kali)-[~]
└─$ rpcclient -U "" -N $TARGET_IP -c "getdompwinfo"
┌──(kali㉿kali)-[~]
└─$ rpcclient -U "$USER%$PASSWORD" $TARGET_IP -c "getdompwinfo"

Then confirm with broader tooling if you have credentials.

┌──(kali㉿kali)-[~]
└─$ enum4linux-ng -A $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u "$USER" -p "$PASSWORD" --pass-pol

What matters is the policy, not the fact that you could enumerate it. A low minimum password length, weak history, or no meaningful lockout threshold changes how you assess authentication risk on the host or domain. A high or missing lockout threshold can make password spraying more viable in a controlled engagement — see AD Password Spraying and AD Password Policy and Spray Surface. A strict lockout policy pushes you away from broad guessing and toward other paths.

If anonymous access returns policy data, keep that too, because it shows the environment leaks useful authentication context before login.

References