SMB & Windows Share Enumeration

You have discovered SMB open on a Windows host during a penetration test. Plan a complete enumeration campaign.

**Unauthenticated Enumeration**
- What information can you gather from SMB without credentials? (OS version, hostname, domain, signing status)
- What is the difference between SMBv1, SMBv2, and SMBv3 from an attack surface perspective?
- How do you check if SMB signing is enforced and why does it matter for relay attacks?
- Can you enumerate shares without credentials? What tools and what to look for?

**Authenticated Enumeration**
- With a valid username and password, what do you enumerate first?
- How do you map readable and writable shares?
- What is the significance of finding SYSVOL or NETLOGON access?
- How do you enumerate Active Directory via LDAP over SMB?

**Common Vulnerabilities to Check**
- EternalBlue (MS17-010): How do you safely test for it without exploiting?
- PrintNightmare: What conditions make a host vulnerable?
- NTLMv1 downgrade: How do you test for it and why is it critical?

**Data Inside Shares**
- Once you have read access to shares, what files are highest priority?
- How do you search recursively for passwords, credentials, or sensitive configs?
- What file extensions indicate scripts, configs, or backup data?

**NTLM Relay Setup**
- If SMB signing is not required, how does an NTLM relay attack work?
- What is the prerequisite chain: Responder → NTLMRelayX → target?

Output:
- Tool-by-tool enumeration workflow (nmap, smbclient, crackmapexec, enum4linux-ng)
- Quick-win checklist
- Common finding descriptions for report writing