SMTP and SMB Enumeration on Kali Linux

Mail and file services often leak usernames and share names before you try SSH or web logins. This walkthrough covers both protocols on Metasploitable 2 in an authorized pentest lab.

SMTP and SMB enumeration quick start

Export these variables once per shell session. These exports last for the current shell only — re-run the block in a new terminal.

export TARGET=192.168.56.127
export DOMAIN=metasploitable.localdomain
# Proxmox Group 2 lab: export TARGET=10.10.10.30

Before you run the commands below:

• Lab target — TARGET defaults to 192.168.56.127 (Metasploitable 2 on the VirtualBox host-only lab). Confirm the address in your pentest lab guide if your layout differs.
• Mail hostname — DOMAIN matches the Postfix banner on the default Metasploitable image (metasploitable.localdomain).
• Root vs non-root — The commands here run as a normal Kali user. Package installs need sudo.
• Missing tools — Install the enumeration packages in the tools section if smtp-user-enum or nxc is not found.

After network reconnaissance shows ports 25 and 445 open on $TARGET, confirm one result on each protocol.

SMTP

Test whether Postfix recognizes a lab username with VRFY:

smtp-user-enum -M VRFY -u msfadmin -t "$TARGET"

192.168.56.127: msfadmin exists

An exists line means smtp-user-enum classified the server response as positive; it does not independently prove that the mailbox is usable.

SMB

List shares with an anonymous smbclient session:

smbclient -L "//$TARGET" -N

Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        tmp             Disk      oh noes!
        opt             Disk
        IPC$            IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
        ADMIN$          IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))

SMTP enumeration asks whether usernames or mail recipients exist. SMB enumeration asks what users, shares, and host information the file service exposes. Both answers feed the same reconnaissance phase before credential testing elsewhere in your scope.

What SMTP and SMB enumeration reveal

SMTP and SMB enumeration map identities and resources without sending mail or copying files yet.

On Metasploitable 2, Postfix advertises VRFY in its EHLO banner and Samba 3.0.20 allows null sessions. Those misconfigurations are intentional for lab practice. Production mail servers often restrict or normalize VRFY responses to reduce user enumeration, while modern SMB deployments typically restrict anonymous access.

Install SMTP and SMB enumeration tools

Install or refresh the enumeration packages if your Kali image is missing a tool. Use apt to pull the tools from the Kali repositories:

sudo apt update
sudo apt install -y smtp-user-enum enum4linux netexec smbclient nmap

apt exits silently when the install succeeds. Install enum4linux-ng separately when you want structured JSON or YAML export from the maintained Python rewrite.

Compare SMTP and SMB enumeration tools

Start with a port check, then run SMTP user enumeration before SMB when you want to correlate usernames across services.

SMTP enumeration

Confirm port 25 responds before you guess mailbox names:

nc -zv "$TARGET" 25

(UNKNOWN) [192.168.56.127] 25 (smtp) open

Detect and fingerprint SMTP

Read the service greeting and EHLO capabilities with Netcat:

printf 'EHLO lab\nQUIT\n' | nc -w 5 "$TARGET" 25

220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
250-metasploitable.localdomain
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
221 2.0.0 Bye

The 250-VRFY line means Postfix may confirm usernames on request. That matches what banner grabbing on port 25 usually shows on this image.

VRFY, EXPN, and RCPT TO

SMTP user enumeration works by asking the server to validate recipient names. Servers often disable or normalize responses to reduce information leakage.

Manual VRFY with Netcat

Connect to port 25 and send VRFY for a username you expect on Metasploitable:

printf 'VRFY msfadmin\nQUIT\n' | nc -w 5 "$TARGET" 25

220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
252 2.0.0 msfadmin
221 2.0.0 Bye

A 250 response can indicate successful VRFY where the server returns the verified mailbox. 252 means the server will accept mail for the supplied address but explicitly declines to verify whether that user exists. On this Metasploitable Postfix build, the contrasting 252 versus 550 User unknown responses still create an enumeration signal, but do not treat 252 universally as proof of a valid mailbox. Compare that with an invalid name:

printf 'VRFY notauser999\nQUIT\n' | nc -w 5 "$TARGET" 25

220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
550 5.1.1 <notauser999>: Recipient address rejected: User unknown in local recipient table
221 2.0.0 Bye

550 with "User unknown" means the server rejected the candidate. Record both response styles before you automate sweeps.

Enumerate users with smtp-user-enum

smtp-user-enum automates VRFY, EXPN, and RCPT TO against one name or a wordlist:

smtp-user-enum -M VRFY -u msfadmin -t "$TARGET"

192.168.56.127: msfadmin exists

exists means smtp-user-enum classified the SMTP reply as positive; it does not independently prove that the mailbox is usable. The name may be a mailbox or alias, not proof of an SSH password.

On hosts that disable VRFY, RCPT TO may still leak valid users:

smtp-user-enum -M RCPT -u msfadmin -t "$TARGET"

192.168.56.127: msfadmin exists

On Metasploitable, RCPT TO confirmed the same account as VRFY.

Sweep many names from the Metasploit wordlist collection when your scope allows bulk probing:

smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t "$TARGET"

A trimmed run against unix_users.txt reported names such as root, postgres, and nobody as exists. Treat each hit as an SMTP-positive candidate for your report, not as a confirmed interactive login.

Nmap also ships smtp-enum-users, which probes VRFY, EXPN, and RCPT TO through the NSE engine. That script is categorized as intrusive and external. This guide uses smtp-user-enum for the main wordlist workflow and keeps broader intrusive NSE coverage in the dedicated Nmap NSE scripts guide.

Enumerate SMTP commands with Nmap

The smtp-commands NSE script uses EHLO and HELP to list supported verbs. Nmap classifies it as default, discovery, and safe. It fits the main enumeration workflow:

nmap -n -Pn -p 25 --script smtp-commands "$TARGET"

PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN

The VRFY token in that line confirms the server advertises the command smtp-user-enum relies on.

Optional relay configuration check

smtp-open-relay is more intrusive than smtp-commands. Nmap classifies it as discovery, intrusive, and external because it issues MAIL FROM and RCPT TO combinations to test relay behavior. Run it only when relay policy is in scope:

nmap -n -Pn -p 25 --script smtp-open-relay "$TARGET"

PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-open-relay: Server doesn't seem to be an open relay, all tests failed

Metasploitable Postfix did not relay mail for arbitrary domains in this run. Response differences on VRFY and RCPT still support username enumeration even when relay is closed.

SMB enumeration

Confirm Samba ports respond before you enumerate shares:

nc -zv "$TARGET" 139 445

(UNKNOWN) [192.168.56.127] 139 (netbios-ssn) open
(UNKNOWN) [192.168.56.127] 445 (microsoft-ds) open

Detect SMB and identify the host with NetExec

NetExec (nxc) is the maintained successor to CrackMapExec on current Kali images. Read the host line before you request shares:

nxc smb "$TARGET"

SMB  192.168.56.127  445  METASPLOITABLE  [*] Unix (name:METASPLOITABLE) (domain:localdomain) (signing:False) (SMBv1:True) (Null Auth:True)

That single line can report:

• NetBIOS hostname (METASPLOITABLE)
• Platform hints (Unix)
• Domain or workgroup (localdomain)
• SMB signing state (signing:False)
• Legacy SMBv1 support (SMBv1:True)
• Whether anonymous connections are permitted (Null Auth:True)

Record each field before you move to share and user enumeration.

Test anonymous and null-session access

A null session attempts SMB or RPC access with an empty username and password:

• Older or intentionally vulnerable systems may expose shares, users, or policy data without credentials
• Modern Windows domains usually restrict anonymous access

NetExec makes the null-session attempt explicit:

nxc smb "$TARGET" -u '' -p ''

SMB  192.168.56.127  445  METASPLOITABLE  [*] Unix (name:METASPLOITABLE) (domain:localdomain) (signing:False) (SMBv1:True) (Null Auth:True)
SMB  192.168.56.127  445  METASPLOITABLE  [+] localdomain\:

The [+] line means the empty credential pair authenticated for enumeration on this lab build.

Enumerate SMB shares with NetExec

List shares and permission hints when null access works:

nxc smb "$TARGET" -u '' -p '' --shares

SMB  192.168.56.127  445  METASPLOITABLE  [*] Enumerated shares
SMB  192.168.56.127  445  METASPLOITABLE   Share           Permissions     Remark
SMB  192.168.56.127  445  METASPLOITABLE   tmp             READ,WRITE      oh noes!
SMB  192.168.56.127  445  METASPLOITABLE   print$                          Printer Drivers
SMB  192.168.56.127  445  METASPLOITABLE   opt
SMB  192.168.56.127  445  METASPLOITABLE   IPC$                            IPC Service (metasploitable server (Samba 3.0.20-Debian))
SMB  192.168.56.127  445  METASPLOITABLE   ADMIN$                          IPC Service (metasploitable server (Samba 3.0.20-Debian))

Finding a share name and having READ or WRITE access are different results. tmp with READ,WRITE is worth recording even when other shares show blank permission columns.

On some Samba builds, NetExec share listing returns STATUS_ACCESS_DENIED while enum4linux or smbclient still succeed. Fall back to those tools instead of treating the host as fully patched.

Enumerate SMB users with NetExec

When the target permits it, NetExec can list local accounts:

nxc smb "$TARGET" -u '' -p '' --users

On this Metasploitable retest, the user table header appeared but no accounts were returned through NetExec alone. Use enum4linux -U when you need a reliable user list on this image.

Enumerate SMB shares with enum4linux

enum4linux wraps rpcclient, smbclient, and nmblookup calls. Run share enumeration alone to keep output readable:

enum4linux -S "$TARGET"

Trimmed share output from the lab run:

[+] Got domain/workgroup name: WORKGROUP
[+] Server 192.168.56.127 allows sessions using username '', password ''

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        tmp             Disk      oh noes!
        opt             Disk
        IPC$            IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))
        ADMIN$          IPC       IPC Service (metasploitable server (Samba 3.0.20-Debian))

Enumerate SMB users with enum4linux

User enumeration through RPC returned lab and service accounts:

enum4linux -U "$TARGET"

Trimmed user output:

Account: msfadmin
Account: postgres
user:[msfadmin] rid:[0xbb8]

Compare SMB users with SMTP hits. When msfadmin appears on both port 25 and port 445, you have a stronger candidate for the next authorized credential-testing phase on SSH or other services.

Modern alternative with enum4linux-ng

enum4linux-ng is the maintained Python rewrite on Kali. It adds structured JSON or YAML export and flags such as -U, -G, -S, -P, and -A for all-in-one runs. Install it when your image does not include the package:

sudo apt install -y enum4linux-ng

Run a full enumeration pass and write structured JSON and YAML export files:

mkdir -p ~/enum-reports
enum4linux-ng -A -oA ~/enum-reports/metasploitable-enum "$TARGET"

The -oA prefix creates companion .json and .yaml files you can feed into reporting or automation pipelines:

ls -1 ~/enum-reports/metasploitable-enum.*

/home/kali/enum-reports/metasploitable-enum.json
/home/kali/enum-reports/metasploitable-enum.yaml

Use enum4linux-ng when you want machine-readable output for reporting pipelines. The original enum4linux commands above remain valid on Kali and are easier to read section by section in tutorials.

Browse accessible shares with smbclient

smbclient confirms automated results and shows what a null session can actually open.

List shares without a password prompt (-N):

smbclient -L "//$TARGET" -N

-L lists share names. -N skips the password prompt for anonymous access.

Connect to a share your scope allows you to browse and list its contents in one non-interactive pass:

smbclient "//$TARGET/tmp" -N -c 'ls'

Anonymous login successful
  .                                   D        0  Sun Aug 30 17:26:31 2026
  ..                                 DR        0  Sun May 20 11:36:12 2012
  orbit-msfadmin                     DR        0  Sun Aug 30 03:25:32 2026

If listing succeeds, note readable paths in your report. Do not modify lab files unless your scope includes active testing beyond enumeration.

What each SMB result means

You do not need to treat every row as a vulnerability during enumeration. Record what the service exposed and verify access separately.

Correlate SMTP and SMB findings

Cross-protocol agreement strengthens a username or share lead:

A username independently exposed by both services is a stronger lead than one produced by a single protocol response. The table below captures protocol, tool, and follow-up in one place:

Cross-check SMB results with Nmap NSE SMB scripts when you want scripted workgroup details on port 445 without running enum4linux again.

What to do after enumeration

Enumeration stops at mapping users, commands, and shares. In your report, record:

• SMTP verbs enabled and usernames that returned positive VRFY or RCPT responses
• SMB hostname, domain, signing state, share names, and permission columns
• Usernames that appeared on more than one service

Password spraying, brute force, relay attacks, and exploitation belong in separate lessons and require explicit scope. On systems you defend, restrict or normalize VRFY on mail listeners, block anonymous SMB where it is not required, and monitor bulk VRFY or null-session probes.

Troubleshooting

Summary

You walked two common leak paths on Metasploitable 2: SMTP on port 25 and SMB on ports 139 and 445. Manual VRFY with Netcat showed 252 for msfadmin and 550 User unknown for an invalid name before smtp-user-enum classified the same account as exists. Nmap smtp-commands confirmed VRFY in the EHLO capability list, while smtp-open-relay stayed optional and reported that Postfix did not relay arbitrary domains in this lab.

On SMB, NetExec identified the host, null authentication, disabled signing, and SMBv1 support, then listed tmp with READ,WRITE permissions under a null session. enum4linux and smbclient confirmed the same shares, and enum4linux -U surfaced msfadmin and postgres alongside system accounts through RPC.

Correlate SMTP and SMB username hits before you move to the next authorized credential-testing phase on SSH or other services in your scope. Never run these enumeration steps against hosts outside your written engagement scope.

References

• smtp-user-enum (Kali)
• enum4linux (GitHub)
• enum4linux-ng (GitHub)
• NetExec (GitHub)
• Samba smbclient man page
• Nmap smtp-commands script
• Nmap smtp-open-relay script
• Postfix disable_vrfy_command parameter
• Metasploitable 2 exploitability guide (Rapid7)

[[FAQ]]