# SMB Enumeration

> Master the Server Message Block protocol. Learn to extract users, shares, and passwords, and exploit misconfigurations to gain initial access or lateral movement.

Canonical: https://codelivly.com/rooms/smb-enumeration
Last updated: 2026-07-10

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

SMB (Server Message Block) is the backbone of Windows file sharing, and it is the most frequently abused protocol in penetration testing. Amateurs just run enum4linux, copy the output, and move on. Professionals understand the underlying RPC calls, know how to authenticate with null sessions, extract user lists for password spraying, and identify writable shares that lead directly to Remote Code Execution (RCE).

In this module, we will dissect the SMB protocol, master the essential enumeration tools (smbclient, smbmap, and the modern NetExec), and learn how to turn a simple misconfigured share into a full domain compromise. Stop just looking at open ports. Start extracting the keys to the Windows kingdom.

## Lessons

1. Understanding SMB (30 min)
2. enum4linux Walkthrough (30 min)
3. smbclient & smbmap: Browsing, Accessing, and Exfiltrating Shares (30 min)
4. Common SMB Misconfigurations (30 min)
5. Guided Lab: Extracting Credentials from an Open Share (30 min)

## Related

- [Learning path: Recon & Enumeration Tools](https://codelivly.com/learning-paths/recon-enumeration-tools)
- [All rooms](https://codelivly.com/rooms)