Labs / ethical hacking

SMB Enumeration on a Deliberately Vulnerable Lab Target

intermediate EVE-NG/VM lab with a purpose-built vulnerable practice VM (e.g. Metasploitable) — never a real production system enumerationsmbnetwork-security

Scenario

Authorization note: this lab must only be run against a purpose-built vulnerable practice VM (such as Metasploitable) inside your own isolated lab network — never against a real or production system. Your goal is to go beyond “port 445 is open” and extract actual detail: shares, and whether anonymous access is allowed.

What you need

  • An attacker VM with enum4linux and smbclient installed.
  • A purpose-built vulnerable practice VM (e.g. Metasploitable, which is specifically designed and published for this kind of learning) on the same isolated lab network.

Step 1 — Confirm SMB is open

attacker$ nmap -p 139,445 192.168.100.30

Confirm both SMB-related ports show open before enumerating further.

Step 2 — List available shares anonymously

attacker$ smbclient -L 192.168.100.30 -N

The -N flag attempts a null (anonymous) session. Record which shares are listed — on a deliberately vulnerable target, you’ll typically see shares that shouldn’t be anonymously listable in a real production environment.

Step 3 — Run a full enumeration pass

attacker$ enum4linux -a 192.168.100.30

This pulls together share listings, user and group information, and OS details into one report — exactly the kind of consolidated detail the enumeration phase is meant to produce.

Step 4 — Attempt to connect to an open share

attacker$ smbclient //192.168.100.30/<share-name> -N

If the connection succeeds anonymously, this is a real, reportable finding: anonymous SMB share access, not just a theoretical risk.

Step 5 — Write the finding, not just the command output

Draft a short finding using the report structure from Penetration Test Reporting: impact (what an attacker could actually access), evidence (your enum4linux/smbclient output), and remediation (disable anonymous/null sessions, restrict share permissions).

Break it

Compare your results against a properly hardened SMB configuration (anonymous access disabled) if you have access to one, and confirm the same commands now return little to nothing — this contrast is a useful thing to describe in an interview.

Reference

  • AddySec original content — written for the Ethical Hacking track, building on Service Enumeration and Penetration Test Reporting.