What is SMB?
SMB (Server Message Block) is a network file-sharing protocol. It lets a computer access files on another server. Windows commonly uses it; Samba on Linux and many NAS devices also provide SMB services.
Take the made-up path \\fileserver\Training\readme.txt: • fileserver is the server name. • Training is the share name—the entry point the administrator exposes. • readme.txt is a file beneath that entry point.
SMB enumeration includes querying share names, types, and comments. Where access permits, it can also reveal directory and file information within a share. Microsoft SMB overview
What happens between connecting and reading a file?
Separate four checks: • Find the service: SMB directly over TCP commonly uses port 445. A responding port is an entry-point clue; confirm the service from its protocol response. • Agree on communication: the client and server negotiate supported SMB versions and capabilities. • Establish the identity: create a session and authenticate as required by the configuration. • Check the action: connect to the specified share, then evaluate each request to list, read, or modify.
“Who is acting?” and “What are they allowed to do?” are separate questions. Anonymous, Guest, and named accounts are different identities; record which one was actually used. SMB over TCP
A guide to the checks. Keep evidence for each stage.
- Service
Confirm the TCP connection and SMB response.
- Negotiation
Record the version and capabilities actually used.
- Identity
Record the identity used by the session.
- Specific action
Identify the share, full path, action, and result.
How do you read what a tool returns?
Windows provides management interfaces for querying shares. Samba’s smbclient can query shares, connect, and perform file operations.
For example, smbclient -L lists services offered by a server. Listing a directory or downloading a file after connecting to a share is a separate action. The information returned depends on the query, identity, and server settings. Samba manual
Microsoft’s NetShareEnum also retrieves share information. Level 0 returns names; Level 1 adds types and comments. These levels specify fields to return, not a guarantee of anonymous access. NetShareEnum
Connect the ideas with a made-up example
This is a synthetic authorized-lab record, not a query we ran. The same test account, labuser, is used throughout, and the target and actions have been agreed on: • Query shares: receive Training and Finance. • List Training: see readme.txt. • Read Training\readme.txt: receive the synthetic test content. • Read the agreed Finance\test.txt: receive ACCESS_DENIED. • Modify, upload, and delete: not tested.
A useful record says: “labuser obtained two share names and read the specified Training test file. The request to read Finance\test.txt was denied. The cause and permissions for other actions need separate checks.”
A refusal for one file describes that request. It does not establish that the whole share is unreadable or that every user lacks access.
A synthetic example with the same labuser and server. These are separate actions, not permission levels.
- List share names
Training and Finance names are visible.
- Read a test file
Training\readme.txt is read successfully.
- Read another test file
Finance\test.txt returns ACCESS_DENIED.
- Modify / upload / delete
Untested here; check separately within authorization.
How do share and file permissions work together?
On a Windows file server using NTFS, network file access requires checking both: • Share permissions: access allowed through the network share. • NTFS permissions: file-system rules for the particular folder or file.
For example, a share may allow reading while the file’s effective permissions do not allow that account to read it. The read remains restricted. Check group membership, inheritance, and deny rules as well.
ACCESS_DENIED can also involve authentication or SMB security policy. Identify the step that failed, then inspect the full reply, identity, and logs. Microsoft access-denied troubleshooting
ABE (Access-Based Enumeration) can change which files and folders appear inside a share based on permissions. It controls visibility; access controls still govern reading and writing. Enumeration settings inside a share
How do you protect the service and record evidence?
Limit SMB to the networks and identities that need it. Set share and file permissions according to work requirements, maintain supported versions and updates, and review unusual sign-ins and file actions.
Keep transport protections distinct: • SMB signing helps verify message integrity and detect tampering in transit. • SMB encryption protects the confidentiality of traffic.
Whether protection is used or required depends on the version, negotiation, and effective policy. Encrypted connections still require file-access permission checks. SMB signing · SMB encryption and security
Record the time, target, identity, share and full path, action, protocol and protection conditions, and raw reply. Practice only in authorized environments with synthetic files.
One small check
You can list the Finance share name, but reading the agreed test.txt returns ACCESS_DENIED. In two or three sentences, what have you confirmed? What should you check next to explain the refusal and determine modification permissions?
This teaching check awaits your answer. The page does not submit answers or update understanding. Q&A awaits actual questions and discussion. Next is M04-05 NetBIOS enumeration.
Concept Q&A
Pending: related questions will be edited into anonymous teaching notes when available.