Tools - enum4linux

root@kali:~# enum4linux
enum4linux v0.8.9 (http://labs.portcullis.co.uk/application/enum4linux/)
Copyright (C) 2011 Mark Lowe (mrl@portcullis-security.com)

Simple wrapper around the tools in the samba package to provide similar 
functionality to enum.exe (formerly from www.bindview.com).  Some additional 
features such as RID cycling have also been added for convenience.

Usage: ./enum4linux.pl [options] ip

Options are (like "enum"):
    -U        get userlist
    -M        get machine list*
    -S        get sharelist
    -P        get password policy information
    -G        get group and member list
    -d        be detailed, applies to -U and -S
    -u user   specify username to use (default "")  
    -p pass   specify password to use (default "")   

The following options from enum.exe aren't implemented: -L, -N, -D, -f

Additional options:
    -a        Do all simple enumeration (-U -S -G -P -r -o -n -i).
              This opion is enabled if you don't provide any other options.
    -h        Display this help message and exit
    -r        enumerate users via RID cycling
    -R range  RID ranges to enumerate (default: 500-550,1000-1050, implies -r)
    -K n      Keep searching RIDs until n consective RIDs don't correspond to
              a username.  Impies RID range ends at 999999. Useful 
	      against DCs.
    -l        Get some (limited) info via LDAP 389/TCP (for DCs only)
    -s file   brute force guessing for share names
    -k user   User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none)
              Used to get sid with "lookupsid known_username"
    	      Use commas to try several users: "-k admin,user1,user2"
    -o        Get OS information
    -i        Get printer information
    -w wrkg   Specify workgroup manually (usually found automatically)
    -n        Do an nmblookup (similar to nbtstat)
    -v        Verbose.  Shows full commands being run (net, rpcclient, etc.)

RID cycling should extract a list of users from Windows (or Samba) hosts 
which have RestrictAnonymous set to 1 (Windows NT and 2000), or "Network 
access: Allow anonymous SID/Name translation" enabled (XP, 2003).

NB: Samba servers often seem to have RIDs in the range 3000-3050.

Dependancy info: You will need to have the samba package installed as this 
script is basically just a wrapper around rpcclient, net, nmblookup and 
smbclient.  Polenum from http://labs.portcullis.co.uk/application/polenum/ 
is required to get Password Policy info.

root@kali:~# enum4linux -U -o 192.168.5.100 
WARNING: ldapsearch is not in your path.  Check that package is installed and your PATH is sane.
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Mar 27 22:47:45 2016

 ========================== 
|    Target Information    |
 ========================== 
Target ........... 192.168.5.100
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===================================================== 
|    Enumerating Workgroup/Domain on 192.168.5.100    |
 ===================================================== 
[+] Got domain/workgroup name: WORKGROUP

 ====================================== 
|    Session Check on 192.168.5.100    |
 ====================================== 
[+] Server 192.168.5.100 allows sessions using username '', password ''

 ============================================ 
|    Getting domain SID for 192.168.5.100    |
 ============================================ 
could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED
could not obtain sid for domain WORKGROUP
error: NT_STATUS_ACCESS_DENIED
[+] Can't determine if host is part of domain or part of a workgroup

 ======================================= 
|    OS information on 192.168.5.100    |
 ======================================= 
[+] Got OS info for 192.168.5.100 from smbclient: Domain=[WORKGROUP] OS=[Windows 7 Professional 7601 Service Pack 1] Server=[Windows 7 Professional 6.1]
[E] Can't get OS info with srvinfo: NT_STATUS_ACCESS_DENIED

 ============================== 
|    Users on 192.168.5.100    |
 ============================== 
[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED

[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED
enum4linux complete on Sun Mar 27 22:47:46 2016

root@kali:~# enum4linux -U -u admin -p password -o 192.168.5.100
WARNING: ldapsearch is not in your path.  Check that package is installed and your PATH is sane.
Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Mar 27 22:50:00 2016

 ========================== 
|    Target Information    |
 ========================== 
Target ........... 192.168.5.100
RID Range ........ 500-550,1000-1050
Username ......... 'admin'
Password ......... 'password'
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===================================================== 
|    Enumerating Workgroup/Domain on 192.168.5.100    |
 ===================================================== 
[+] Got domain/workgroup name: WORKGROUP

 ====================================== 
|    Session Check on 192.168.5.100    |
 ====================================== 
[+] Server 192.168.5.100 allows sessions using username 'admin', password 'password'

 ============================================ 
|    Getting domain SID for 192.168.5.100    |
 ============================================ 
Domain Name: WORKGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup

 ======================================= 
|    OS information on 192.168.5.100    |
 ======================================= 
[+] Got OS info for 192.168.5.100 from smbclient: Domain=[DESKTOP] OS=[Windows 7 Professional 7601 Service Pack 1] Server=[Windows 7 Professional 6.1]
[+] Got OS info for 192.168.5.100 from srvinfo:
	192.168.5.100  Wk Sv PrQ NT PtB LMB 
	platform_id     :	500
	os version      :	6.1
	server type     :	0x51203

 ============================== 
|    Users on 192.168.5.100    |
 ============================== 
index: 0x1 RID: 0x3e8 acb: 0x00000214 Account: admin	Name: (null)	Desc: (null)
index: 0x2 RID: 0x1f4 acb: 0x00000211 Account: Administrateur	Name: (null)	Desc: Compte d’utilisateur d’administration
index: 0x3 RID: 0x3ea acb: 0x00000210 Account: HomeGroupUser$	Name: HomeGroupUser$	Desc: Compte intégré pour un accès Groupe résidentiel à l’ordinateur
index: 0x4 RID: 0x1f5 acb: 0x00000215 Account: Invité	Name: (null)	Desc: Compte d’utilisateur invité
index: 0x5 RID: 0x3ee acb: 0x00000210 Account: System	Name: System Account	Desc: Compte utilisé par System
index: 0x6 RID: 0x3eb acb: 0x00000210 Account: totouser	Name: totouser	Desc: (null)
index: 0x7 RID: 0x3ec acb: 0x00000210 Account: titiuser	Name: titiuser	Desc: (null)

user:[admin] rid:[0x3e8]
user:[Administrateur] rid:[0x1f4]
user:[HomeGroupUser$] rid:[0x3ea]
user:[Invité] rid:[0x1f5]
user:[System] rid:[0x3ee]
user:[totouser] rid:[0x3eb]
user:[titiuser] rid:[0x3ec]
enum4linux complete on Sun Mar 27 22:50:01 2016