enum4linux is a Perl-based reconnaissance tool built specifically to enumerate information from Windows and Samba systems over SMB/RPC. It was written by Mark Lowe (Portcullis Labs) as a re-implementation and wrapper around the Samba suite of tools (smbclient, rpcclient, net, nmblookup), combining their output into a single, easy-to-read report. It has been a staple of Windows/Active Directory enumeration since the early 2000s and remains preinstalled on Kali Linux.
enum4linux can pull:
- Workgroup/domain name
- OS version and build information
- Host SID (Security Identifier)
- User listing (via RID cycling and SAMR queries)
- Group listing and membership
- Shares (and whether they are accessible)
- Password policy information
- Printer information
It is most effective against older Windows versions (2000/2003/2008/2012) and Samba servers, and against any host where null sessions (unauthenticated SMB connections) are permitted, though it also supports authenticated enumeration with a valid username/password.
Installation
enum4linux ships by default in Kali Linux. If it is missing or you are on a different distribution:
# Kali Linux (already installed, but to reinstall/update)
sudo apt update
sudo apt install enum4linux -y
# Verify installation
enum4linux -h
which enum4linux
# Manual install from source (Debian/Ubuntu)
git clone https://github.com/portcullislabs/enum4linux.git
cd enum4linux
chmod +x enum4linux.pl
sudo ln -s $(pwd)/enum4linux.pl /usr/local/bin/enum4linux
Dependencies (installed automatically via apt): perl, samba-common-bin (provides rpcclient, net, nmblookup, smbclient).
Syntax
enum4linux [options] <ip address>
Command-Line Options
| Option | Description |
|---|---|
-U | Get userlist |
-M | Get machine list |
-S | Get sharelist |
-P | Get password policy information |
-G | Get group and member list |
-d | Be detailed, applies to -U and -S |
-u user | Specify username to use (default “”) |
-p pass | Specify password to use (default “”) |
-a | Do all simple enumeration (-U -S -G -P -r -o -n -i). This is the default option if none other is specified. |
-h | Display help message |
-r | Enumerate users via RID cycling |
-R range | RID ranges to enumerate (default 500-550,1000-1050, implies -r) |
-K n | Keep searching RIDs until n consecutive RIDs don’t correspond to a username (impies -r) |
-l | Get some (limited) info via LDAP 389/TCP (for DCs only) |
-s filename | Brute force guessing for share names |
-k user | User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none). Used to get sid with -R |
-o | Get OS information |
-i | Get printer information |
-w wrkg | Specify workgroup manually (usually found automatically) |
-n | Do an nmblookup (similar to nbtstat) |
-v | Verbose. Shows full commands being run (net, rpcclient, etc.) |
Basic Usage
The simplest invocation runs all standard checks (-a) against a target with a null/anonymous session:
enum4linux -a 192.168.56.101
Expected initial output header:
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Jul 19 10:02:11 2026
==========================
| Target Information |
==========================
Target ........... 192.168.56.101
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
Practical Examples
Example 1 — Full basic scan (anonymous session)
enum4linux -a 192.168.56.101
====================================
| Nbtstat Information for 192.168.56.101 |
====================================
Looking up status of 192.168.56.101
METASPLOITABLE <00> - B <ACTIVE> Workstation Service
METASPLOITABLE <03> - B <ACTIVE> Messenger Service
METASPLOITABLE <20> - B <ACTIVE> File Server Service
WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
MAC Address = 00-00-00-00-00-00
Example 2 — Get OS information only
enum4linux -o 192.168.56.101
==================================
| OS information on 192.168.56.101 |
==================================
Got OS info for 192.168.56.101 from smbclient: Unix
Got OS info for 192.168.56.101 from srvinfo:
192.168.56.101 Wk Sv PrQ Unx NT SNT Metasploitable server (Samba 3.0.20-Debian)
platform_id : 500
os version : 4.9
server type : 0x9a03
Example 3 — Enumerate shares
enum4linux -S 192.168.56.101
=====================================
| Share Enumeration on 192.168.56.101 |
=====================================
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
tmp Disk oh noes!
opt Disk
IPC$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian))
ADMIN$ IPC IPC Service (metasploitable server (Samba 3.0.20-Debian))
Server Comment
--------- -------
METASPLOITABLE metasploitable server (Samba 3.0.20-Debian)
Workgroup Master
--------- -------
WORKGROUP METASPLOITABLE
[+] Attempting to map shares on 192.168.56.101
//192.168.56.101/print$ Mapping: DENIED, Listing: N/A
//192.168.56.101/tmp Mapping: OK, Listing: OK
//192.168.56.101/opt Mapping: DENIED, Listing: N/A
//192.168.56.101/IPC$ [E] Can't understand response:
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
//192.168.56.101/ADMIN$ Mapping: DENIED, Listing: N/A
Example 4 — Enumerate users via RID cycling
enum4linux -r -u "" -p "" 192.168.56.101
===============================================
| Users on 192.168.56.101 via RID cycling (RIDs: 500-550,1000-1050) |
===============================================
[I] Assuming that user "" exists
S-1-5-21-1409982668-1417001333-682003330-500 METASPLOITABLE\Administrator (Local User)
S-1-5-21-1409982668-1417001333-682003330-501 METASPLOITABLE\nobody (Local User)
S-1-5-21-1409982668-1417001333-682003330-1000 METASPLOITABLE\msfadmin (Local User)
S-1-5-21-1409982668-1417001333-682003330-1001 METASPLOITABLE\service (Local User)
S-1-5-21-1409982668-1417001333-682003330-1002 METASPLOITABLE\user (Local User)
S-1-5-21-1409982668-1417001333-682003330-1003 METASPLOITABLE\postgres (Local User)
Example 5 — Password policy enumeration
enum4linux -P 192.168.56.101
=============================================
| Password Policy Information for 192.168.56.101 |
=============================================
[+] Attaching to 192.168.56.101 using a NULL share
[+] Trying protocol IPC$ with NULL account
[+] Found domain(s):
[+] METASPLOITABLE
[+] Builtin
[+] Password Info for Domain: METASPLOITABLE
[+] Minimum password length: 5
[+] Password history length: None
[+] Maximum password age: Not Set
[+] Password Complexity Flags: 000000
[+] Minimum password age: None
[+] Reset Account Lockout Counter: 30 minutes
[+] Locked Account Duration: 30 minutes
[+] Account Lockout Threshold: None
[+] Forced Log off Time: Not Set
Example 6 — Group and member enumeration
enum4linux -G 192.168.56.101
=======================================
| Groups on 192.168.56.101 |
=======================================
[+] Getting builtin groups:
group:[Administrators] rid:[0x220]
group:[Backup Operators] rid:[0x227]
group:[Guests] rid:[0x222]
group:[Users] rid:[0x221]
[+] Getting builtin group memberships:
Group 'Administrators' (RID: 544) has member: METASPLOITABLE\root
Example 7 — Authenticated enumeration with known credentials
enum4linux -u msfadmin -p msfadmin -a 192.168.56.101
Username ......... 'msfadmin'
Password ......... 'msfadmin'
...
[+] Server 192.168.56.101 allows sessions using username 'msfadmin', password 'msfadmin'
Example 8 — Custom RID range enumeration
enum4linux -r -R 500-600 192.168.56.101
[I] Assuming that user "" exists
S-1-5-21-...-500 METASPLOITABLE\Administrator (Local User)
S-1-5-21-...-501 METASPLOITABLE\nobody (Local User)
...
S-1-5-21-...-600 *unknown*\*unknown* (SID_ERROR)
Example 9 — Verbose mode showing underlying commands
enum4linux -v -U 192.168.56.101
[V] Attempting to get userlist with command: rpcclient -U'' -N 192.168.56.101 -c 'enumdomusers'
=========================================
| Users on 192.168.56.101 via RPC |
=========================================
index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: msfadmin Name: msfadmin,,, Desc: (null)
Example 10 — Piping output to a file for reporting
enum4linux -a 192.168.56.101 | tee enum4linux_192.168.56.101.txt
Starting enum4linux v0.9.1 ...Common Use Cases
- Initial null-session SMB enumeration against Windows/Samba hosts discovered by nmap on port 139/445
- Enumerating local user accounts on older, unpatched Windows/Samba servers for password-spraying target lists
- Extracting SMB share names to identify accessible/writable shares for lateral movement or data exfiltration
- Pulling password policy to inform brute-force/lockout-safe attack throttling
- Quick single-tool “kitchen sink” report during CTFs (e.g., OSCP-style boxes such as Metasploitable2)
Automation with Bash
Scan a whole subnet and save individual reports per host:
#!/bin/bash
# enum4linux_sweep.sh - Run enum4linux -a against every live host in a subnet
SUBNET="192.168.56.0/24"
OUTDIR="./enum4linux_results"
mkdir -p "$OUTDIR"
for ip in $(nmap -p 139,445 --open -oG - "$SUBNET" | awk '/Up$/{next} /445\/open/{print $2}'); do
echo "[*] Enumerating $ip"
enum4linux -a "$ip" > "$OUTDIR/${ip}.txt" 2>&1
done
echo "[+] Done. Results in $OUTDIR"
Extract just the discovered usernames from a batch of reports:
grep -h "Local User" "$OUTDIR"/*.txt | awk -F'\\' '{print $2}' | awk '{print $1}' | sort -u > all_users.txt
Tips and Best Practices
- Always try an anonymous/null session first (
-u "" -p "", the default) before assuming credentials are required. - Combine
-vwith a specific flag (e.g.,-v -U) when troubleshooting, so you can see and re-run the exact underlyingrpcclient/netcommand manually. - RID cycling (
-r) can be slow and noisy; narrow the-Rrange if you already know the domain has few accounts, or widen it (e.g.,500-2000) for large AD environments. - Save raw output with
teeor redirection for every host — enum4linux output is a primary source for later exploitation planning. - Cross-verify results with
enum4linux-ngandrpcclientdirectly, sinceenum4linuxoccasionally mis-parses Samba banners on very old or very new Samba versions.
Troubleshooting
| Problem | Likely Cause | Solution |
|---|---|---|
Server doesn't allow session using username '', password '' | Null sessions disabled on target | Supply valid credentials with -u/-p, or note this as a security-positive finding |
| Script hangs on RID cycling | Large -R range against a slow link | Reduce range or add -K to stop after n consecutive misses |
Can't find include file smb.conf type errors | Broken Samba client install | sudo apt install --reinstall samba-common-bin |
| Empty share list despite port 445 open | SMB signing/newer protocol restrictions (SMB3-only host) | Use enum4linux-ng or smbclient -L with --option='client min protocol=SMB2' |
Perl warnings about Encode.pm | Locale/encoding mismatch | Run with LC_ALL=C enum4linux ... |
References
- Official repository: https://github.com/portcullislabs/enum4linux
- Kali Linux tool page: https://www.kali.org/tools/enum4linux/
- Samba project documentation: https://www.samba.org/samba/docs/
- Successor tool: enum4linux-ng — https://github.com/cddmp/enum4linux-ng