Network Enumeration

SMB, SMTP and SNMP Enumeration

Name: Abdelmoneim Belal
Date: 4/9/2026
Target: Metasploitable 2
Attacker Machine: Kali Linux

1. Introduction

Enumeration is an important phase of a penetration testing assessment. It involves gathering detailed information about a target system and the services running on it.

Unlike basic port scanning, which mainly identifies open ports and services, enumeration focuses on interacting with those services to discover additional information such as usernames, shared resources, service configurations, supported commands, operating system details, and other useful data.

The information collected during enumeration helps penetration testers understand the attack surface of the target and identify potential security weaknesses that may require further investigation.

In this lab, enumeration was performed against a Metasploitable 2 virtual machine using Kali Linux. The assessment focused on three network services: SMB, SMTP, and SNMP.

The following tools were used:

• Nmap
• smbclient
• smtp-user-enum
• Netcat
• Metasploit Framework

All testing was performed in an isolated lab environment for educational and authorized penetration testing purposes.

2. Methodology

The assessment followed a basic enumeration methodology:

1. Identify the target system.
2. Identify exposed network services.
3. Enumerate SMB services.
4. Enumerate SMTP services.
5. Enumerate SNMP services.
6. Repeat service enumeration using Metasploit Framework.
7. Analyze the information discovered.
8. Evaluate how the discovered information could potentially assist an attacker.

The objective was not to exploit the target but to understand how much information could be obtained from exposed services during the enumeration phase.

3. SMB Enumeration

3.1 Introduction to SMB

Server Message Block (SMB) is a network protocol commonly used for file and printer sharing and for accessing network resources.

SMB commonly operates over TCP ports 139 and 445.

During this assessment, SMB enumeration was performed using Nmap and smbclient.

3.2 SMB Enumeration Using Nmap

The first step was to identify the SMB services exposed by the target.

Command

nmap -p 139,445 -sV 192.168.232.129

The scan was used to identify the services running on ports 139 and 445 and determine the SMB/Samba version exposed by the target.

Screenshot

Figure 1 — SMB service detection using Nmap

Findings

The Nmap scan identified the SMB-related services exposed by the target.

The scan provided information about the open SMB ports and the service/version information returned by the target.

This information is useful during penetration testing because identifying the SMB implementation and version can help determine what additional enumeration techniques or security checks should be performed.

3.3 SMB Share Enumeration Using Nmap Scripts

The following Nmap script was used to enumerate SMB shares:

Command

nmap -p 139,445 --script smb-enum-shares 192.168.232.129

Screenshot

Figure 2 — SMB share enumeration

Findings

The Nmap SMB share enumeration identified five SM shares exposed by the target:

• ADMIN$ — IPC share; anonymous access was not available.
• IPC$ — IPC share; anonymous READ/WRITE access was available.
• opt — Disk share; anonymous access was not available.
• print$ — Disk share used for printer drivers; anonymous access was not available.
• tmp — Disk share; anonymous READ/WRITE access was available.

The SMB service identified itself as Samba 3.0.20-Debian.

The most significant finding was that the IPC$ and tmp shares allowed anonymous READ/WRITE access. This indicates that an unauthenticated user could interact with these SMB resources without providing valid credentials.

From a security perspective, anonymous read/write access to network shares can potentially allow unauthorized users to access or modify resources. This information would therefore be important for further security testing and should be reviewed by the system administrator.

3.4 SMB Enumeration Using smbclient

The smbclient utility was used to enumerate available SMB shares.

Command

smbclient -L //192.168.232.129/ -N

The -L option requests a list of available shares, while -N attempts the connection without requesting a password.

Screenshot

Figure 3 — SMB shares discovered using smbclient

Findings

The smbclient enumeration successfully connected to the target using anonymous authentication.

The following SMB shares were identified:

• print$ — Disk share used for printer drivers.
• tmp — Disk share with the comment oh noes!.
• opt — Disk share.
• IPC$ — IPC share used for inter-process communication.
• ADMIN$ — IPC share associated with the Samba service.

The enumeration also identified the SMB workgroup as WORKGROUP and the server as METASPLOITABLE.

The most important finding was that anonymous login was successful, allowing an unauthenticated user to enumerate the available SMB shares remotely.

If any of these shares provide read or write access without authentication, an attacker could potentially access, modify, or gather additional information from exposed resources. Further testing would be required to determine the exact level of access.

3.5 SMB Security Impact

The information obtained from SMB enumeration could potentially help an attacker:

• Identify available network shares.
• Identify potentially accessible resources.
• Discover information about the SMB/Samba configuration.
• Identify potential targets for further investigation.
• Determine whether anonymous access is permitted.

Proper SMB configuration should restrict unnecessary exposure and prevent unauthorized access to sensitive resources.

4. SMTP Enumeration

4.1 Introduction to SMTP

Simple Mail Transfer Protocol (SMTP) is a protocol used primarily for sending and transferring email messages.

SMTP commonly operates on TCP port 25.

During this lab, SMTP enumeration was performed using Nmap, smtp-user-enum, and Netcat.

4.2 SMTP Enumeration Using Nmap

The SMTP service was first identified using Nmap.

Command

nmap -p 25 -sV 192.168.232.129

Screenshot

Figure 4 — SMTP service detection

Findings

The scan identified an SMTP service running on the target.

The service/version information discovered was:

Service: Host: metasploitable.localdomain
Version: Postfix smtpd

The SMTP banner and version information can provide useful information for understanding the target’s email service and determining which enumeration techniques may be applicable.

4.3 SMTP Command Enumeration Using Nmap

The smtp-commands Nmap script was used to identify commands supported by the SMTP server.

Command

nmap -p 25 --script smtp-commands 192.168.232.129

Screenshot

Figure 5 — SMTP commands discovered using Nmap

Findings

The Nmap SMTP enumeration identified that the target’s SMTP service is running on TCP port 25 and responded to the enumeration request.

The SMTP server identified itself as metasploitable.localdomain and exposed several supported SMTP commands and capabilities, including:

• PIPELINING — Allows the server to process multiple SMTP commands in a single connection.
• SIZE 10240000 — Indicates that the server supports messages up to approximately 10 MB.
• VRFY — Can be used to verify whether a specific mailbox or username exists on the server.
• ETRN — Allows a client to request mail delivery from a remote server.
• STARTTLS — Indicates support for upgrading the SMTP connection to TLS encryption.
• ENHANCEDSTATUSCODES — Provides enhanced SMTP status codes.
• 8BITMIME — Indicates support for 8-bit MIME messages.
• DSN — Indicates support for Delivery Status Notifications.

The most interesting finding from a security enumeration perspective is the presence of the VRFY command. If enabled and not properly restricted, it may allow an attacker to verify valid usernames or mailboxes on the SMTP server, which can assist in further enumeration and targeted attacks.

Security Impact

Exposing SMTP capabilities provides useful information about the mail server and its configuration. In particular, an unrestricted VRFY command could potentially allow username enumeration. This information could be used as a starting point for further security testing.

4.4 SMTP User Enumeration Using smtp-user-enum

The smtp-user-enum tool was used to test whether the SMTP server could provide information about valid usernames.

Get Abdelmoneim Belal’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

A wordlist containing possible usernames was created for the assessment.

Example Wordlist

root
admin
msfadmin
user
postgres
service

Command

smtp-user-enum -M VRFY -U users.txt -t 192.168.232.129

Screenshot

Figure 6 — SMTP username enumeration

Findings

The smtp-user-enum tool successfully identified five potentially valid usernames on the target SMTP server using the VRFY method.

The following usernames were identified:

• root
• user
• msfadmin
• postgres
• service

The tool tested 6 usernames from the provided wordlist and identified 5 valid accounts.

This confirms that the SMTP server responds to VRFY requests in a way that allows valid usernames to be distinguished from invalid ones.

Security Impact

Username enumeration can disclose valid accounts on the target system. This information could assist an attacker during further security testing, such as password auditing or authentication testing, because the attacker no longer needs to guess which usernames are valid.

The exposure of accounts such as root, msfadmin, and postgres may provide particularly useful information about the services and users present on the target system.

Evidence

Figure 5 — SMTP username enumeration using smtp-user-enum

The screenshot demonstrates that the SMTP server responded positively to VRFY requests for five usernames.

4.5 SMTP Enumeration Using Netcat

Netcat was used to connect directly to the SMTP service.

Command

nc 192.168.232.129 25

The SMTP server returned a banner identifying the service.

Screenshot

Figure 7 — SMTP banner using Netcat

The SMTP server was then queried using commands such as:

EHLO kali

and:

HELP

If supported by the server, the VRFY command was also tested:

VRFY root

Screenshot

Figure 8 — SMTP command interaction using Netcat

Findings

The Netcat connection allowed direct interaction with the SMTP service on TCP port 25.

The SMTP banner revealed that the target is running:

Banner: 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)

After establishing the connection, the EHLO command was used to identify the SMTP capabilities supported by the server. The server responded with:

• PIPELINING
• SIZE 10240000
• VRFY
• ETRN
• STARTTLS
• ENHANCEDSTATUSCODES
• 8BITMIME
• DSN

The HELP command returned an error indicating that the command was not recognized:

502 5.5.2 Error: command not recognized

The VRFY root command returned:

252 2.0.0 root

This response indicates that the SMTP server processed the VRFY request for the root username and did not reject the query.

This manual interaction confirmed the SMTP behavior observed during the previous Nmap and smtp-user-enum enumeration steps.

Security Impact

Direct SMTP interaction can reveal service banners, supported capabilities, and potentially valid usernames. In this case, the enabled VRFY functionality was particularly useful because it could be used to distinguish valid usernames from invalid ones.

This information can assist an attacker during further reconnaissance and authentication-related security testing.

4.6 SMTP Security Impact

SMTP enumeration may provide attackers with:

• SMTP server information.
• Supported commands.
• Potentially valid usernames.
• Information about the email infrastructure.
• Additional information useful for future attacks.

Disabling unnecessary information disclosure and properly configuring SMTP authentication can reduce the amount of information exposed to unauthenticated users.

5. SNMP Enumeration

5.1 Introduction to SNMP

Simple Network Management Protocol (SNMP) is commonly used to monitor and manage network devices and systems.

SNMP commonly uses UDP port 161.

SNMP can potentially expose information such as:

• System information.
• Hostname.
• Network information.
• System uptime.
• Device configuration information.
• Other management information.

5.2 SNMP Enumeration Using Nmap

The SNMP service was first identified using Nmap.

Command

nmap -sU -p 161 192.168.232.129

Screenshot

Figure 9 — SNMP service detection

Findings

The scan identified the SNMP service on UDP port 161.

Because SNMP uses UDP, the -sU option was used to perform UDP scanning.

5.3 SNMP Information Enumeration

The Nmap snmp-info script was used to gather additional information from the SNMP service.

Command

nmap -sU -p 161 --script snmp-info 192.168.232.129

Screenshot

Figure 10 — SNMP information enumeration

Findings

The scan confirmed that the target host was reachable. However, UDP port 161 was reported as closed.

The relevant output was:

PORT    STATE  SERVICE
161/udp closed snmp

Since the SNMP port was closed, the snmp-info script was unable to retrieve additional SNMP information from the target.

Therefore, no information was obtained regarding the system description, system name, system location, or system uptime.

SNMP Enumeration Results

• Port: 161/UDP
• State: Closed
• Service: SNMP
• System Description: Not available
• System Name: Not available
• System Location: Not available
• System Uptime: Not available

Because UDP port 161 was reported as closed, the snmp-info script was unable to retrieve additional SNMP information from the target.

Therefore, no system information such as the hostname, system description, location, or uptime was obtained during this enumeration attempt.

5.4 Security Impact

No SNMP information disclosure was observed during this enumeration attempt because the SNMP service was not accessible through UDP port 161.

The result indicates that, at the time of testing, the target did not expose an accessible SNMP service on the scanned port. Therefore, further SNMP enumeration could not be performed using the snmp-info script.

This finding does not necessarily prove that SNMP is completely absent from the target, as the service could potentially be configured on another port, restricted by firewall rules, or unavailable at the time of testing.