# 3. Null Session SMB Enumeration

\
Now we are trying to **enumerate SMB shares** using a **null session** — which means trying to access the SMB service _without any username or password_. This is useful when the server is misconfigured and allows anonymous access.

#### ✅ Method 1: Using `smbclient`

```bash
smbclient -NL //192.168.10.4
```

**Explanation:**

* `-N` → No password prompt (null session)
* `-L` → List available SMB shares on the target
* `//IP` → Target IP in UNC format

🔍 **Look for**:

* `IPC$` → Named pipes (usually always there)
* `NETLOGON`, `SYSVOL`, `Users` → Might contain useful data in domain environments



I tried method 1 but it didn't work : \


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FpTrjmw6Kvx1Yh3Nl0otW%2Fimage.png?alt=media&#x26;token=dc773086-be2b-4f81-a831-e6db67e6dc38" alt=""><figcaption></figcaption></figure>

So let's head to method 2.&#x20;

#### ✅ Method 2: Using `netexec` (formerly `crackmapexec`)

```bash
netexec smb 192.168.10.4 -u '' -p '' --shares
```

**Explanation:**

* `-u ''` → Empty username
* `-p ''` → Empty password
* `--shares` → Tells the tool to enumerate shared folders

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F1pbJJoS2tHtVEv5r7R6k%2Fimage.png?alt=media&#x26;token=ba93ceca-499d-41b4-bac1-74545d5bdb74" alt=""><figcaption></figcaption></figure>

✅ Now you **successfully connected** to the SMB service using a **null session** (no username/password).

> `[*] Windows 10 / Server 2019 Build 17763 x64`\
> This confirms the target is likely a **Windows Server 2019**, in the `megachange.nyx` domain.

#### ❌ **But... Access Denied**

> `[-] Error enumerating shares: STATUS_ACCESS_DENIED`

This means **anonymous access is not allowed** to list SMB shares. The server requires authentication to view them.



### 🔐 If Access Denied?

We have to try valid credentials later:

```bash
netexec smb 192.168.10.4 -u USERNAME -p PASSWORD --shares
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FfhneUpKWPDAmp3PcKaZJ%2Fimage.png?alt=media&#x26;token=2fcdfa77-81fe-4646-b1bb-f112afe3f048" alt=""><figcaption></figcaption></figure>

It doesn't matter to login now, all we need is the `FQDN` : `megachange.nyx`
