enum4linux-ng - A next generation version of enum4linux (a Windows

项目说明

<h1 align="center">enum4linux-ng</h1>
<p align="center">
<strong>A next generation of enum4linux</strong>
</p>
<p align="center">
<img src="
<img src="
</p>

enum4linux-ng.py is a rewrite of Mark Lowe's (former Portcullis Labs now Cisco CX Security Labs) enum4linux.pl, a 工具 for enumerating information from Windows and Samba systems, aimed for security professionals and CTF players. The 工具 is mainly a wrapper around the Samba tools nmblookup, net, rpcclient and smbclient.

I made it for educational purposes for myself and to o issues with enum4linux.pl. It has the same functionality as the original 工具 (though it does some things differently). Other than the original 工具 it parses all output of the Samba tools and allows to export all findings as YAML or JSON file. The idea behind this is to allow other tools to import the findings and further process them. It is planned to add new features in the future.

Features

support for YAML and JSON export

colored console output (can be disabled via NO_COLOR)

ldapsearch and polenum are natively implemented

support for multiple authentication methods

support for legacy SMBv1 connections

auto detection of IPC signing support

'smart' enumeration will automatically disable tests which would otherwise fail

timeout support

SMB dialect checks

IPv6 support (experimental)

Differences

Some things are implemented differently compared to the original enum4linux. These are the important differences:

group members are not enumerated by default, this can be enabled with

RID cycling is not part of the default enumeration () but can be enabled with

RID cycling can be achie, by grouping multiple SID lookups in the same rpcclient call

parameter naming is slightly different (e.g. instead of )

Credits

I'd like to thank and gi to the people at former Portcullis Labs (now Cisco CX Security Labs), namely:

Mark Lowe for creating the original 'enum4linux.pl' ()

Richard 'deanx' Dean for creating the original 'polenum' ()

In addition, I'd like to thank and gi to:

Craig 'Wh1t3Fox' West for his fork of 'polenum' ()

It was lots of fun reading your code! :)

Last but not least, I’d like to thank the people who contributed code, reported issues, and provided helpful suggestions on how to improve the tool.

Legal note

If you use the tool: Don't use it for illegal purposes.

Run

An example run could look like that:

Demo

#### Windows Server 2012 R2
This demonstrates a run against Windows Server 2012 R2 standard installation. The following command is being used:

A user 'Tester' with password 'Start123!' was created. Firewall access was allowed. Once the enumeration is finished, I scroll up so that the results become more clear. Since no other enumeration option is specified, the tool will assume which beha to enum4linux option. User and password are passed in. The option will export all enumerated data as YAML file for further processing in . The tool automatically detects at the beginning that LDAP is not running on the remote host. It will therefore skip any further LDAP checks which would normally be part of the default enumeration.

!Demo

#### Metasploitable 2
The second demo shows a run against Metasploitable 2. The following command is being used:

This time the and option are used. While the first one beha to enum4linux option, the second one will enable enumeration of services. This time no credentials were provided. The tool automatically detects that it needs to use SMBv1. No YAML or JSON file is being written. Again I scroll up so that the results become more clear.

!Demo

Usage

Installation

There are multiple ways to install the tool. Either the tool comes as a package with your Linux distribution or you need to do a manual install.

Kali Linux

Archstrike

NixOS

(tested on NixOS 20.9)

Manual Installation

If your Linux distribution does not offer a package, the following manual installation methods can be used instead.

Dependencies

The tool uses the samba clients tools, namely:

nmblookup

net

rpcclient

smbclient

These should be a for all Linux distributions. The package is typically called smbclient, samba-client or something similar.

In addition, you will need the following Python packages:


ldap3

PyYaml

impacket

For a faster processing of YAML (optional!) also install (should come as a dependency for PyYaml for most Linux distributions):

LibYAML

Some examples for specific Linux distributions installations are listed below. Alternatively, distribution-agnostic ways (python pip, python env and Docker) are possible.

Linux distribution specific

For all distribution examples below, LibYAML is already a dependency of the corresponding PyYaml package and will be therefore installed automatically.
#### ArchLinux

#### Fedora/CentOS/RHEL
(tested on Fedora Workstation 31)

#### Debian/Ubuntu/Linux Mint
(For Ubuntu 18.04 or below use the Docker or Python en )

Linux distribution-agnostic

#### Python pip
Depending on the Linux distribution either pip3 or pip` is needed:

Alternative:

Remember you need to still install the samba tools as mentioned above.

#### Python en

Then run via:

Remember you need to still install the samba tools as mentioned above. In addition, make sure you run e you spawn a new shell. Otherwise the wrong Python interpreter with the wrong libraries will be used (your system one rather than the en one).

#### Docker

Once finished an example run could look like this:

Contribution and Support

Occassionally, the 工具 will spit out error messages like this:

In that case, please rerun the 工具 with the and option. This will allow you to see the exact command which caused the error message. Copy that command, run it in your terminal and redirect the output to a file. Then open a GitHub issue here, pasting the command and attaching the error output file. That helps to debug the issue. Of course, you can debug it yourself and make a pull request.

If the 工具 is helpful for you, I'm happy if you leave a star!

项目信息

开发语言：Python

Star 数：1669

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A next generation version of enum4linux (a Windows/Samba enumeration 工具) with additional features like JSON/YAML export. Aimed for security professionals and CTF players.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。