enum4linux-ng doesn't find the users enum4linux finds

[sboden]

I've been doings some CTF's from THM and HTB. When the CTF has an exposed SMB service, I can usually get usernames with enum4linux (the perl version), but enum4linux-ng seems to miss them consistently.

[cddmp]

Hi @sboden,

have you tried the latest version which increased the default timeout? Watch closely to the red error messages the tool throws. If you see timeout issues you need to increase the timeout.

Apart from that, maybe enum4linux found the users via RID cycling? You need to enable that explicitly as it not part of the default enum.

[sboden]

I cloned enum4linux-ng, and claude also did find out I had to enable RID cycling. I would make RID cycling default unless I miss "something". I have a tweaked version on my pc where RID cycling is activated by default.

[Bornunique911]

Hi, @sboden .
Can you please share the output or screenshot from enum4linux and enum4linux-ng for finding the usernames and their respective commands you used for it?

I would also like to see the differences between both the current and your tweaked version in the code to make it work.

[sboden]

So I'm writing a CTF solver, starting small with the "basicpentestingjt" CTF from tryhackme.
port 445 is open running a "Samba smbd 4.6.2" according to nmap. And they seem to want you to enumerate the users found on SMB, and then try to guess their password on an ssh service.

The relevant output for enum4linux.pl, note kay and jan users:

==================( Users on 10.64.148.63 via RID cycling (RIDS: 500-550,1000-1050))==================

Found new SID:
S-1-22-1
Found new SID:
S-1-5-32
Found new SID:
S-1-5-32
Found new SID:
S-1-5-32
Found new SID:
S-1-5-32

[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\kay (Local User)
S-1-22-1-1001 Unix User\jan (Local User)
S-1-22-1-1002 Unix User\ubuntu (Local User)

With python3 enum4linux-ng.py -A -R1 10.64.148.63:

 ==================================================================
|    Users, Groups and Machines on 10.64.148.63 via RID Cycling    |
 ==================================================================
[*] Trying to enumerate SIDs
[+] Found 3 SID(s)
[*] Trying SID S-1-22-1
[+] Found user 'Unix User\kay' (RID 1000)
[+] Found user 'Unix User\jan' (RID 1001)
[+] Found user 'Unix User\ubuntu' (RID 1002)
[*] Trying SID S-1-5-21-2853212168-2008227510-3551253869
[+] Found user 'BASIC2\nobody' (RID 501)
[+] Found domain group 'BASIC2\None' (RID 513)
[*] Trying SID S-1-5-32
[+] Found builtin group 'BUILTIN\Administrators' (RID 544)
[+] Found builtin group 'BUILTIN\Users' (RID 545)
[+] Found builtin group 'BUILTIN\Guests' (RID 546)
[+] Found builtin group 'BUILTIN\Power Users' (RID 547)
[+] Found builtin group 'BUILTIN\Account Operators' (RID 548)
[+] Found builtin group 'BUILTIN\Server Operators' (RID 549)
[+] Found builtin group 'BUILTIN\Print Operators' (RID 550)
[+] Found 4 user(s), 8 group(s), 0 machine(s) in total

Using python3 enum4linux-ng.py -A 10.64.148.63 fails as RID cycling is not on by default. Looking at what Claude did as quick fix is following:

@@ -3339,6 +3345,10 @@ def check_arguments():

     if args.A:
         args.N = True
+        # Enable RID cycling by default with -A to match enum4linux.pl behavior
+        # Use default bulk size of 1 if not already set
+        if not args.R:
+            args.R = 1

     # Only global variable which meant to be modified
     GLOBAL_VERBOSE = args.verbose

Claude did some other regex optimizations but I don't think they matter.

For me this can be closed. Personally I would activate RID cycling to 1 by default to make the transition from the enum4linux.pl easier, but once you know you know.

[cddmp]

The main reason I did not enable it by default was that RID cycling is quite noisy. While it is nice for CTF like stuff, it can be an issue during a pentest. I'm not sure what to do about that.

Btw. what many people don't know: you can speed up RID cycling by using -R 100, rather than -R 1 (which is the same as using -R). It will be much faster than the Perl version. Max. value is 2000 currently, the tool then limits input.