Tutorial: Local Enumeration via SMB Service

Local Host: 131.107.1.222/24 (TEST-XP2)
Target Host: 131.107.1.101/24 (DEN-WEB1)

Enumerate Local Domains
Z:\Tools\Nmap>nmap --script=smb-enum-domains 131.107.1.101

Enumerate Shared Folders
Z:\Tools\Nmap>nmap --script=smb-enum-shares 131.107.1.101

Enumerate User Accounts
Z:\Tools\Nmap>nmap --script=smb-enum-users 131.107.1.101

Enumerate User Groups
Z:\Tools\Nmap>nmap --script=smb-enum-groups 131.107.1.101

Enumerate Processes
Z:\Tools\Nmap>nmap --script=smb-enum-processes 131.107.1.101

Enumerate Sessions
Z:\Tools\Nmap>nmap --script=smb-enum-sessions 131.107.1.101

Note:
On Windows, Nmap scripts directory is in Z:\Tools\Nmap\scripts
On Linux (BackTrack), Nmap script directory us in /usr/share/nmap/scripts/
All Nmap scripts have the file extension of .nse (Nmap Scripting Engine) and are written in Lua.