SMB, SMTP and SNMP Enumeration Using Nmap, smbclient and Metasploit

1.Introduction Enumeration is one of the most important phases of a penetration test. It involves gathering detailed information about services, systems, users, shares, and other resources running on a target.

Unlike simple port scanning, enumeration focuses on extracting useful information from the services discovered on the target. This information can help a penetration tester understand the target environment and identify potential security weaknesses.

In this lab, I performed SMB, SMTP, and SNMP enumeration using several tools available in Kali Linux. The tools used were Nmap, smbclient, smtp-user-enum, Netcat, and Metasploit Framework.

1 — Host Discovery and Port Scanning Before starting the enumeration of SMB, SMTP, and SNMP services, I first performed host discovery and port scanning to identify the target machine and determine which ports and services were available.

I used Nmap to check whether the target host was reachable and to identify open ports. This initial step helped me understand the attack surface of the target and determine which services should be investigated further during the enumeration phase.

After identifying the open ports and running services, I used the results as a starting point for the next steps, where I performed more detailed enumeration of SMB, SMTP, and SNMP.

1. SMB Enumeration

nmap -p 139,445 --script "smb-enum*" <TARGET_IP>

nmap -p 139,445 --script "smb-enum*" <TARGET_IP>

Nmap was used to enumerate the SMB service running on ports 139 and 445. The enumeration provided information about the SMB environment, including the available shares/users or other SMB-related information exposed by the target.

Using smbclient

smbclient -L //<TARGET_IP>/ -N

smbclient -L //<TARGET_IP>/ -N

Result: smbclient was used to enumerate the available SMB shares on the target. The output showed the shares that could be accessed or discovered without authentication.

2. SMTP Enumeration

Using Nmap

nmap -p 25 --script smtp-enum-users \
--script-args "smtp-enum-users.methods={VRFY},userdb=/home/kali/Desktop/users.txt" \<TARGET_IP>

nmap -p 25 --script smtp-enum-users \
--script-args "smtp-enum-users.methods={VRFY},userdb=/home/kali/Desktop/users.txt" \<TARGET_IP>

Result: The SMTP enumeration script tested the usernames provided in the user database using the VRFY method. In my test, no accounts were confirmed by Nmap.

Using smtp-user-enum

smtp-user-enum -M VRFY -U users.txt -t <TARGET_IP>

smtp-user-enum -M VRFY -U users.txt -t <TARGET_IP>

Result: smtp-user-enum was used to test whether specific usernames were valid on the SMTP server.

Using Netcat

nc <TARGET_IP> 25

nc <TARGET_IP> 25

Result: Netcat allowed me to interact directly with the SMTP server and manually test SMTP commands. This provided a better understanding of how the SMTP service responds to client requests.

3. SNMP Enumeration

Using Nmap

sudo nmap -sU -p 161 --script snmp* <TARGET_IP>

sudo nmap -sU -p 161 --script snmp* <TARGET_IP>

Result: Nmap was used to enumerate the SNMP service running on UDP port 161. The scan provided information exposed by the SNMP agent, depending on the configured community string and available SNMP information.

4. Enumeration Using Metasploit

5. SMB Enumeration

msfconsole
search smb shares
use <module>
set RHOSTS <TARGET_IP>
run

msfconsole
search smb shares
use <module>
set RHOSTS <TARGET_IP>
run

SMTP Enumeration

msfconsole
search smtp
use <module>
set RHOSTS <TARGET_IP>
set RPORT 25

msfconsole
search smtp
use <module>
set RHOSTS <TARGET_IP>
set RPORT 25

SNMP Enumeration

msfconsole
search snmp
use <module>
set RHOSTS <TARGET_IP>
set RPORT 161
run

msfconsole
search snmp
use <module>
set RHOSTS <TARGET_IP>
set RPORT 161
run

Tools Used

1. Nmap Nmap is a network scanning and enumeration tool used to discover open ports, running services, and additional information about a target using NSE scripts.

2. smbclient smbclient is a command-line tool used to interact with SMB services and enumerate available shared folders and resources.

3. smtp-user-enum smtp-user-enum is a tool used to test whether specific usernames may exist on an SMTP server using supported SMTP methods such as VRFY.

4. Netcat (nc) Netcat is a network utility that can establish direct connections to network services. In this lab, it was used to connect to the SMTP server and manually interact with it.

5. Metasploit Framework Metasploit is a penetration testing framework that provides modules for discovering and enumerating information about different network services, including SMB, SMTP, and SNMP.

6. SNMP SNMP itself is a network management protocol rather than an enumeration tool. It is used to monitor and manage network devices, and when improperly configured, it may expose useful system and network information.

7. Attacker Perspective

A short reflection on how attackers could use this information. How Attackers Could Use This Information Enumeration can provide attackers with valuable information about a target environment before attempting further attacks.

SMB enumeration may reveal shared resources, usernames, and information about the Windows environment. SMTP enumeration may reveal valid usernames or information about the mail server. SNMP enumeration can expose information about network devices, interfaces, system details, and other configuration information depending on how SNMP is configured.

This information can help an attacker understand the target and identify potential attack paths. From a defensive perspective, unnecessary information disclosure should be minimized, services should be properly configured, and weak default configurations such as publicly accessible SNMP community strings should be avoided.

6. Conclusion This lab helped me understand the practical importance of enumeration in penetration testing. I used multiple tools to enumerate SMB, SMTP, and SNMP services and compared how different tools can collect information from the same type of service.

The main lesson from this lab is that enumeration is not simply about finding open ports. It is about understanding what those services reveal and how that information can be used to assess the security of a target.