SMB Null-Session Enumeration
ad · easy · +25 XP
// what is SMB Null-Session Enumeration?
SMB null sessions are unauthenticated connections to the IPC$ share on Windows systems, exploiting a legacy design where anonymous access was permitted for backward compatibility. When RestrictAnonymous is disabled (default on older systems), attackers enumerate domain users, shares, groups, password policies, and SIDs without credentials. This is a critical foothold technique in Active Directory recon, turning zero access into a username list for password spraying or AS-REP roasting.
// how attackers detect it
- [01]Use enum4linux with
-aflag:enum4linux -a <target>— successful user/share enumeration without credentials confirms null session vulnerability - [02]Run rpcclient with blank credentials:
rpcclient -U '' -N <target>thenenumdomusers— if users dump without authentication, null sessions are enabled - [03]Test with smbclient:
smbclient -L //<target> -N— listing shares anonymously indicates IPC$ allows null binding - [04]Use CrackMapExec:
crackmapexec smb <target> -u '' -p '' --shares— shares visible with empty credentials confirm misconfiguration
// how defenders prevent it
- ✓Set RestrictAnonymous = 2 in registry at
HKLM\SYSTEM\CurrentControlSet\Control\Lsato block all anonymous SID/name translation - ✓Disable Network access: Let Everyone permissions apply to anonymous users via GPO under Computer Configuration → Security Settings → Local Policies → Security Options
- ✓Remove Everyone and Anonymous Logon groups from Pre-Windows 2000 Compatible Access group using
net localgroup "Pre-Windows 2000 Compatible Access" /delete - ✓Enable SMB signing and restrict SMBv1 via
Set-SmbServerConfiguration -EnableSMB1Protocol $falseto reduce legacy attack surface
// real-world incidents
CVE-2020-1472
Zerologon — Netlogon privilege escalation
Null-session enumeration reveals domain controllers vulnerable to cryptographic bypass allowing instant domain admin takeover
CVE-2017-0143
EternalBlue — SMBv1 remote code execution
Null sessions identify SMBv1-enabled targets exploitable for pre-auth RCE via buffer overflow in transaction handling
// hands-on tips for this lab
- ›Start with enum4linux -a for comprehensive output, then pivot to rpcclient for interactive enumeration if initial dump is restricted — commands like
querydominfo,enumdomgroups, andgetdompwinforeveal password policy and structure - ›If null session fails, try guest account (
-U 'guest' -N) — many labs intentionally leave guest enabled when null is blocked, both achieve similar enumeration - ›Parse enum4linux output for usernames then feed directly into kerbrute userenum or AS-REP roast attempts — the real goal is building a target list, not just viewing shares
was this lesson helpful?