ciscocxsecurity / enum4linux

enum4Linux is a Linux alternative to enum.exe for enumerating data from Windows and Samba hosts

enum4linux

A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.

Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from www.bindview.com.

It is written in Perl and is basically a wrapper around the Samba tools smbclient, rpclient, net and nmblookup.

The tool usage can be found below followed by examples, previous versions of the tool can be found at the bottom of the page.

Also see: https://labs.portcullis.co.uk/tools/enum4linux/

enum4linux's Issues

Changes needed to Samba configuration to use with Server 2012 R2

Recently while trying enum4linux against a Server 2012 R2 target (with credentials, null sessions are long dead), I realized that Samba tools/utilities need to be forced to use SMB3. As per the release notes here: https://www.samba.org/samba/history/samba-4.1.0.html, following must be added to the [global] section of smb.conf (default is /etc/samba/smb.conf)

client max protocol = SMB3

After adding that, it again worked like a charm!

Maybe add a note/warning in the tool for adding the configuration? Individual utilities can be patched in the code as well (for example smbclient -m SMB3). That, of course, will be up to you.

Thanks for this awesome tool :)

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#enum4linux

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

• Open source: Every information is available and up to date. If an information is missing or deprecated, you are invited to (help us).
• Practical: Content is categorized and table formatted, allowing to search, browse, sort and filter.
• Fast: Using static and client side technologies resulting in fast browsing.
• Rich tables: search, sort, browse, filter, clear
• Fancy informational popups
• Badges / Shields
• Static API
• Twitter bot

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why?

• Specialized websites: Some websites are referencing tools but additional information is not available or browsable. Make additional searches take time.
• Curated lists: Curated lists are not very exhaustive, up to date or browsable and are very topic related.
• Search engines: Search engines sometimes does find nothing, some tools or resources are too unknown or non-referenced. These is where crowdsourcing is better than robots.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool, more and more people are using the Rawsec's CyberSecurity Inventory, this helps them find what they need.

Badges

The badge shows to your community that your are inventoried. This also shows you care about your project and want it growing, that your tool is not an abandonware.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make the project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care.

polenum ImportError: cannot import name dcerpc_v4

I' m running the latest kali rolling with a fresh install of enum4linux.
Every time I run enum4linux recently it fails with the following error message, where only the complexity and min password length is shown.
Using the enum.exe equivalent on windows works fine.
I understand this may be a dependancy thing, but would appreciate any help :)

===================================================
|    Password Policy Information for 192.168.0.3    |
 =================================================== 
[E] Unexpected error from polenum:
Traceback (most recent call last):
  File "/usr/bin/polenum", line 33, in 
    from impacket.dcerpc import dcerpc_v4, dcerpc, transport, samr
ImportError: cannot import name dcerpc_v4
[+] Retieved partial password policy with rpcclient:

Password Complexity: Enabled
Minimum Password Length: 7

Every packages are installed and working, paths are set correctly. Someone please solve this issue.

enum4linux -a 10.10.11.108
ERROR: nmblookup is not in your path. Check that samba package is installed
ERROR: net is not in your path. Check that samba package is installed
ERROR: rpcclient is not in your path. Check that samba package is installed
ERROR: smbclient is not in your path. Check that samba package is installed
WARNING: polenum is not in your path. Check that package is installed and your PATH is sane.
WARNING: ldapsearch is not in your path. Check that package is installed and your PATH is sane.
For Gentoo, you need to install the "samba" package
For Debian, you need to install the "smbclient" package

Use of uninitialized value $user, what does this mean?

Use of uninitialized value $users in print at ./enum4linux.pl line 874.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 877.

Use of uninitialized value $users in print at ./enum4linux.pl line 888.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 890.

$global_workgroup is unitialized

Using v0.8.9

From the error output below it seems that the function sub make_session and others is trying to use the $global_workgroup even though it is not supplied on the command line. The man page says that workgroup is usually found automatically, but if it is not $global_workgroup seems to be empty and result in this error below. I suggest that if $global_workgroup is empty output that it is not found and go on using WORKGROUP.
The error below resulted from the command: enum4linux -a x.x.x.x

Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 437.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 451.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 359.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 458.
Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 467.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 866.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 881.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 640.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 501.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 542.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 593.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 710.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 742.
Use of uninitialized value $global_workgroup in concatenation (.) or string at ./enum4linux.pl line 991.

Use of uninitialized value $os_info in concatenation (.) or string at /bin/enum4linux line 464.

for some time I can't use -o on enum4linux
I have try ti find out the issue.. and I think is smbclient has changed..
enum4linux is trying:
smbclient -W 'MYGROUP' //'xx.xx.x.xx'/ipc$ -U''%'' -c 'q' 2>&1
but returns nothing..

smbclient when connected does not output any information anymore

I went into the code I see no issue:

# Get OS info
 456 sub get_os_info {
 457   print_heading("OS information on $global_target");
 458   my $command = "smbclient -W '$global_workgroup' //'$global_target'/ipc\$ -U'$global_username'\%'$global_password' -c 'q' 2>&1";
 459   print "[V] Attempting to get OS info with command: $command\n" if $verbose;
 460   my $os_info = `$command`;
 461   chomp $os_info;
 462   if (defined($os_info)) {
 463     ($os_info) = $os_info =~ /(Domain=[^\n]+)/s;
 464     print "[+] Got OS info for $global_target from smbclient: $os_info\n";
 465   }

so I think smbclient newer versions are missing something
anyone have an idea to fix this with out going to an old version of smbclient?

Share enum skips shares with spaces in their names

The share enumeration and listing function has a bug where it will skip listing the permissions/contents of shares with spaces in their name. You'll see them in the raw list of shares but you won't see anything about them in the following section.

Bug is the regex on line 651:

my @shares = $shares =~ /\n\s+(\S+)\s+(?:Disk|IPC|Printer)/igs;

Fixed regex should be:

my @shares = $shares =~ /\n\s+(.+?)\s+(?:Disk|IPC|Printer)/igs;

I can pull request if you prefer, let me know. There may be a similar bug in enum_shares_unauth() on line 681 - haven't tested but looks like the same issue.

Arch error message

So i keep receiving the following error message when enum4linux is run:

WARNING: polenum.py is not in your path. Check that package is installed and your PATH is sane.

The package polenum is definitely installed and yet I am still having this issue.
HELP!

enum4linux using Python2 deprecated

Hello,
I see that enum4linux is using polenum that (probably) requires Python2, but it is deprecated and it is a big security concern having it installed in a system.

I see this when I install it by BlackArch repo:

$ sudo pacman -S enum4linux

resolving dependencies...
looking for conflicting packages...

Package (5)           New Version   Net Change  Download Size

core/openldap         2.6.3-2         4.60 MiB       1.52 MiB
blackarch/polenum     19.6fb4e3b-1    0.04 MiB       0.02 MiB
blackarch/python2     2.7.18-6       70.37 MiB      12.76 MiB
core/unixodbc         2.3.11-1        0.89 MiB       0.25 MiB
blackarch/enum4linux  0.9.1-2         0.06 MiB       0.02 MiB

enum4linux is a wonderful tool. Could you please making it using Python3 instead of Python2?

https://archlinux.org/news/removing-python2-from-the-repositories/

Thank you

Packets not present in the path

I tried to use the utility but I get this error.

I tried to reinstall smbclient but still the same error, here is my PATH too:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
I'm under Kali linux 2021.

@kali:/$ enum4linux 10.10.163.75
ERROR: nmblookup is not in your path. Check that samba package is installed
ERROR: net is not in your path. Check that samba package is installed
ERROR: rpcclient is not in your path. Check that samba package is installed
ERROR: smbclient is not in your path. Check that samba package is installed
WARNING: polenum is not in your path. Check that package is installed and your PATH is sane.
WARNING: ldapsearch is not in your path. Check that package is installed and your PATH is sane.
For Gentoo, you need to install the "samba" package
For Debian, you need to install the "smbclient" package

enum_shares misparses shares when sharename IPC$ is present.

Currently the regex that parses the share names misparses when presented with a sharename of IPC, due to allowing groups to cross line boundaries.

Current regex with a sample:

This is confirmed with running in verbose:

This fix would be to alter the regex to only parse line-by-line (and include the previous fix for shares with spaces.

Updated regex with a sample: