Jul 19, 202636 min read

Service Enumeration with nimux

Use nimux to assess scan results, SMB, LDAP, WinRM, MSSQL, RDP, HTTP, FTP, WebDAV, NFS, SSH, VNC, MySQL, PostgreSQL, and AFP services.

EnumerationProtocolsRDPSMB

Overview

Not every useful assessment path is Active Directory. File services, web services, databases, remote shells, and legacy protocols often expose weak authentication, sensitive files, or administration surfaces. nimux includes native protocol checks for a broad set of services so operators can keep discovery and validation in one command surface.

This article covers practical service checks with neutral examples.

Start with scan output

Use scan to identify where deeper protocol checks make sense. The scanner supports TCP, UDP, common top-port presets, JSON output, and protocol-specific probe tuning for MSSQL and RDP.

nimux scan 10.10.10.0/24 --port 21,22,80,111,135,139,389,445,548,5900,5985,1433,3306,3389 --open

nimux scan dc01.corp.local --port 88,135,139,389,445,464,593,3389 --open --json

nimux scan dc01.corp.local --udp --port 53,88,123,137,161,464

For large scopes, keep scan output structured:

nimux scan @hosts.txt --top-ports 100 --open --json > service-scan.jsonl

SMB

SMB enumeration is usually one of the first authenticated checks in Windows environments. nimux supports share discovery, SAMR users and groups, password policy, logged-on users, sessions, disks, and RID brute forcing.

nimux smb fileserver01.corp.local -d corp.local -u operator -p '<password>' --shares

nimux smb dc01.corp.local -d corp.local -u operator -p '<password>' --users --groups --pass-pol

nimux smb dc01.corp.local -d corp.local -u operator -H <nt_hash> --rid-brute 5000

Session and workstation information can help identify active administrative paths:

nimux smb fileserver01.corp.local -d corp.local -u operator -p '<password>' --sessions --loggedon-users --disks

Use --json when correlating SMB results with later LDAP, WinRM, or MSSQL checks.

LDAP

LDAP checks provide directory context around exposed services. Use named queries for common Active Directory questions, and raw filters when you need precise attributes.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query users

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query computers --query trusts --query gpos --query dcs

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query asreproast --query kerberoast

Raw filters are useful for targeted service validation:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(adminCount=1)' \
  --attrs sAMAccountName,distinguishedName

DNS zones and certificate inventory are also exposed through LDAP shortcuts:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' --query dns --query certs

When pivoting through a SOCKS route, LDAP supports --proxy:

nimux ldap dc01.internal.corp.local -d corp.local -u operator -p '<password>' \
  --proxy socks5://127.0.0.1:1088 --query computers

WinRM

WinRM checks validate remote management reachability and, when authorized credentials are available, command execution or shell access. nimux supports NTLM password, NTLM hash, Kerberos cache, cleartext HTTP, and TLS.

nimux winrm workstation01.corp.local -d corp.local -u operator -p '<password>' --cmd whoami

nimux winrm workstation01.corp.local -d corp.local -u operator -H <nt_hash> --cmd hostname

nimux winrm workstation01.corp.local -d corp.local -k --ccache operator.ccache --cmd hostname

nimux winrm workstation01.corp.local -d corp.local -u operator -p '<password>' --ssl --cmd hostname

Interactive mode includes remote directory changes, upload, download, recursive transfer, and managed assembly execution:

nimux winrm workstation01.corp.local -d corp.local -u operator -p '<password>' --shell

RDP

The RDP module performs X.224 negotiation, TLS certificate collection, and NTLM-info probing. Treat it as a service fingerprint and exposure check, not as an interactive RDP client.

nimux rdp workstation01.corp.local

nimux rdp workstation01.corp.local --json

nimux rdp workstation01.corp.local --rdp-proto 3 --timeout 3000

Record certificate names, protocol negotiation behavior, and whether the service is exposed on unexpected hosts.

MSSQL

MSSQL service validation can move from authentication to SQL execution and, where authorized, command execution. nimux supports SQL authentication, Windows authentication through NTLM, Kerberos SSPI, linked servers, impersonation checks, dangerous setting audits, xp_cmdshell, OLE Automation, CLR, --shell, and --cli.

nimux mssql sql01.corp.local -u sql_user -p '<password>' --query 'SELECT @@version'

nimux mssql sql01.corp.local -d corp.local -u operator -H <nt_hash> --query 'SELECT SYSTEM_USER'

nimux mssql sql01.corp.local -d corp.local -k --ccache sql-user.ccache \
  --spn MSSQLSvc/sql01.corp.local:1433 \
  --query 'SELECT SYSTEM_USER'

Audit high-impact capabilities before attempting execution:

nimux mssql sql01.corp.local -u sql_user -p '<password>' --enum-danger --enum-impersonate

Interactive SQL mode gives a controlled place to inspect databases, linked servers, and impersonation context:

nimux mssql sql01.corp.local -u sql_user -p '<password>' --cli

whoami
serverinfo
databases
use application
tables
links
impersonate app_admin
revert
exit

Only use --cmd, --ole, --clr, or linked-server execution when the assessment scope explicitly allows command execution.

HTTP and HTTPS

Use HTTP probes for headers, title, body fingerprinting, and authenticated paths.

nimux http web01.corp.local --path /

nimux https web01.corp.local --path /admin

nimux https web01.corp.local -u operator -p '<password>' --path /dav/

Use JSON when collecting many hosts:

nimux http @web-hosts.txt --path / --json > http-results.jsonl

FTP

FTP supports auth checks, listing, and an interactive client.

nimux ftp ftp01.corp.local

nimux ftp ftp01.corp.local -u operator -p '<password>' --ls

nimux ftp ftp01.corp.local -u operator -p '<password>' --cli

Interactive helpers include:

ls
cd incoming
pwd
get report.txt
put marker.txt
mkdir nimux-test
rm marker.txt
exit

WebDAV

WebDAV can expose file operations over HTTP or HTTPS.

nimux webdav webdav01.corp.local -u operator -p '<password>'

nimux webdav webdav01.corp.local --ssl -u operator -p '<password>' --cli

Use the interactive client for scoped listing and file validation:

ls
cd Shared
get policy.txt
put marker.txt
rm marker.txt
exit

NFS

NFS starts with export discovery.

nimux nfs nfs01.corp.local

nimux nfs nfs01.corp.local --cli

Interactive NFS helpers include:

exports
use /srv/share
ls
stat backup.tar
cat notes.txt
get notes.txt ./notes.txt
put marker.txt marker.txt
chmod 600 marker.txt
exit

The NFS client also supports suid <bin> [name] and sshkey <pub> [path]. These are high-impact write paths and should only be used in a lab or when explicitly authorized.

SSH

SSH supports authentication checks, one-shot commands, and an interactive shell.

nimux ssh linux01.corp.local -u operator -p '<password>'

nimux ssh linux01.corp.local -u operator -p '<password>' --cmd id

nimux ssh linux01.corp.local -u operator -p '<password>' --shell

Use SSH for low-impact command validation on Linux or network devices when credentials are in scope.

MySQL and MariaDB

nimux mysql db01.corp.local -u app_user -p '<password>'

nimux mysql db01.corp.local -u app_user -p '<password>' --cli

Interactive helpers:

whoami
dbs
use application
tables
SELECT user();
exit

PostgreSQL

PostgreSQL supports SQL queries, interactive client mode, and OS command execution through COPY FROM PROGRAM when the account is a superuser.

nimux postgres pg01.corp.local -u postgres -p '<password>' --query 'SELECT version()'

nimux postgres pg01.corp.local -u postgres -p '<password>' --database appdb --cli

nimux postgres pg01.corp.local -u postgres -p '<password>' --cmd id

nimux postgres pg01.corp.local -u postgres -p '<password>' --shell

Use --cmd and --shell only when COPY FROM PROGRAM is authorized and the role has the required privilege.

AFP

AFP can still appear in mixed environments.

nimux afp filemac01.corp.local

nimux afp filemac01.corp.local -u operator -p '<password>' --cli

Helpers include:

shares
use Shared
ls
cd Documents
get note.txt
put marker.txt
mkdir nimux-test
exit

VNC

VNC checks are simple and should be scoped carefully.

nimux vnc workstation01.corp.local

nimux vnc workstation01.corp.local -p '<vnc-password>'

Document whether the server allows no-auth or password authentication.

Reporting

For service enumeration, report the service, host, authentication result, account used, protocol behavior, sensitive file exposure, command capability, and cleanup. Avoid broad claims. A precise finding such as “NFS export allowed read access to backup files” is stronger than “NFS was open.”

Install nimux View features Open docs