# External Enumeration

External enumeration involves gathering information about Windows systems from outside the network. Techniques like SMB probing, Nmap scanning, and DNS zone transfers help identify active hosts, exposed services, and potential vulnerabilities before gaining internal access.

## Network Discovery

Identify live hosts and gather basic network information to map out the target environment.

### Nmap

Enumerating hosts using ping scan.

```bash
nmap -sn <TARGET_SUBNET>
```

### Zone Transfer

Zone transfers can reveal detailed DNS information, including records for hosts within the domain.

```bash
dig axfr <domain_name>@<name_server>
```

### Smb

Enumerating `smb` hosts:

```
nxc smb <target_subnet>
```

<figure><img src="https://2512022398-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDEayJi9GHvyJiOCEYxK%2Fuploads%2FWT8bw6Ughgyc9AzmAq7V%2Fimage.png?alt=media&#x26;token=c1b4b88e-2e07-4795-8df0-05d512228816" alt=""><figcaption><p>smb - hosts enumeration</p></figcaption></figure>

{% hint style="info" %}
Note: DC smb signing is true by default.
{% endhint %}

## Service and Port Scanning

Enumerate open ports and running services to identify potential entry points.

### Nmap

Scanning specific hosts:

```bash
nmap -Pn -p- -sC -sV -oN <output_file> <target>
```

* `-Pn` don’t do ping scan
* `-p-` scan the 65535 ports instead of the default `nmap` 1000 top ports
* `-sC` run default script for reconnaissance
* `-sV` enumerate the version
* `-oN` write results in normal format

### RPC

Checking for Null Sessions:

```bash
rpcclient -U "" <target>
```

## Active Directory Reconnaissance

Gather detailed information about Active Directory environments, including users, groups, and policies.

### Find DCs

```bash
nslookup -type=srv _kerberos._tcp.dc._msdcs.<domain> <target_ip>
```

<figure><img src="https://2512022398-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhDEayJi9GHvyJiOCEYxK%2Fuploads%2FInWE6S6NAb8BfMqggxKV%2Fimage.png?alt=media&#x26;token=d28a133a-9d24-4058-af6a-e9e786f178f6" alt=""><figcaption></figcaption></figure>

### Enum4linux

```bash
enum4linux -U <target>
```

### RPC

Connect anonymously

```bash
rpcclient -U "<domain_name>\\" <target> -N
```

Enumerate users:

```bash
rpcclient $> enumdomusers
```

### SMB

```bash
nxc smb <target> -u '' -p '' --shares
nxc smb <target> -u 'a' -p '' --shares
nxc smb <target> -u 'guest' -p '' --shares
```

Enumerate valid users:

{% hint style="info" %}
Note: blank and not blank usernames can make a difference even when login anonymously.
{% endhint %}

```bash
nxc smb <target> -u '' -p '' -
nxc smb <target> -u 'a' -p '' 
nxc smb <target> -u 'guest' -p ''
```

```bash
# Enumerate users
nxc smb <target> -u '' -p '' --users

# Perform RID Bruteforce to get users
nxc smb <target> -u '' -p '' --rid-brute

# Enumerate domain groups
nxc smb <target> -u '' -p '' --groups

# Enumerate available shares
nxc smb <target> -u '' -p '' --shares
smbclient -L //<target> -N

# Get the active sessions
nxc smb <target> -u '' -p '' --sessions

# Get the password policy
nxc smb <target> -u '' -p '' --pass-pol
```

## Users Enumeration

### NXC

```bash
nxc smb <target> -u <userlist_file> -p <pass> --continue-on-success
```

### Kerbrute

```
kerbrute userenum <userlist_file> -d <domain_name> --dc <dc_ip>
```

## References

{% embed url="<https://mayfly277.github.io/posts/GOADv2-pwning_part1/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://dudisamarel.gitbook.io/oscp-notes/windows/enumeration/external-enumeration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.