SMB enumeration with a guest/null session

Before having credentials, a Windows SMB server may still answer a null session (empty username and password) or the guest account, which in many installations is left enabled with no password. That low-privilege session is often enough to list shares, read the ones with loose permissions, enumerate users and the password policy, and from there chain the rest of the attack.

Mechanism

The first step is checking what each session type reveals. With netexec/crackmapexec over SMB you test both:

netexec smb <ip> -u '' -p '' --shares               # null session
netexec smb <ip> -u guest -p '' --shares            # guest account
netexec smb <ip> -u guest -p '' --users --pass-pol  # users and password policy

It is common for the null session to be accepted but reveal nothing, while guest does list the shares. smbmap gives the same picture with per-share permissions (READ/WRITE), and smbclient -L lists without mounting:

smbmap -u guest -p '' -H <ip>                        # shares + permissions
smbmap -u guest -p '' -H <ip> -R 'HR' --depth 5      # recursive walk of a share
smbclient -N -L //<ip>                               # -N = no password
smbclient -N //<ip>/HR                               # browse a readable share

enum4linux-ng gathers shares, users, groups, policy and RID cycling in a single pass; rpcclient with a null session allows the same by hand:

enum4linux-ng -A <ip>                                 # full enumeration (shares, users, pol, RID)
rpcclient -U "" -N <ip> -c "srvinfo;enumdomusers;querydominfo"

When a share with READ permission shows up, you browse it with smbclient or download it in bulk:

smbclient -N //<ip>/'Department Shares' -c 'recurse ON; prompt OFF; mget *'

What is valuable is rarely the system binary but what people leave in those shares: HR notes with default passwords, scripts with embedded credentials, backups, web.config or unattend.xml. Any of them is the lever for the next step (password-spraying, credential-reuse). The same guest session usually also enables rid-cycling to rebuild the user list and share hunting once you have credentials.

Requirements

A reachable SMB service (445/tcp) that has not disabled anonymous access or the guest account. No credential is needed; the value depends on how much that low-privilege session exposes, which varies widely across versions and hardening.

How to detect it. The guest/null session leaves an Event ID 4624 of type 3 (network) with account name ANONYMOUS LOGON or Guest and Authentication Package NTLM: any anonymous or guest logon against SMB is already a signal, because normal operation uses named accounts. Listing shares generates 5140 (a network share object was accessed) and access to specific files 5145, both with the anonymous/guest subject. An attacker's footprint is that same source walking many shares or files in seconds. Correlating an anonymous 4624 with a burst of 5140/5145 from the same IP gives away pre-credential enumeration.

Defence. Disable the guest account, forbid anonymous access to shares (RestrictNullSessAccess), apply least-privilege permissions on each resource, and do not store secrets in cleartext inside shared folders. Signing SMB and disabling SMBv1 also cuts other abuses over the same port. It is the door to RID cycling, password spraying and share hunting.