137,138,139 - Pentesting NetBios - HackTricks

# 137,138,139 - Pentesting NetBios

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## NetBios Name Service

NetBIOS Name Service plays a crucial role, involving various services such as name registration and resolution, datagram distribution, and session services, utilizing specific ports for each service.

From Wikidepia:

- Name service for name registration and resolution (ports: 137/udp and 137/tcp).
- Datagram distribution service for connectionless communication (port: 138/udp).
- Session service for connection-oriented communication (port: 139/tcp).

### Name Service

For a device to participate in a NetBIOS network, it must have a unique name. This is achieved through a broadcast process where a "Name Query" packet is sent. If no objections are received, the name is considered available. Alternatively, a Name Service server can be queried directly to check for name availability or to resolve a name to an IP address. Tools like `nmblookup`, `nbtscan`, and `nmap` are utilized for enumerating NetBIOS services, revealing server names and MAC addresses.

    PORT    STATE SERVICE    VERSION
    137/udp open  netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)

Enumerating a NetBIOS service you can obtain the names the server is using and the MAC address of the server.

    nmblookup -A <IP>
    nbtscan <IP>/30
    sudo nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>

### Datagram Distribution Service

NetBIOS datagrams allow for connectionless communication via UDP, supporting direct messaging or broadcasting to all network names. This service uses port 138/udp.

    PORT    STATE         SERVICE     VERSION
    138/udp open|filtered netbios-dgm

### Session Service

For connection-oriented interactions, the Session Service facilitates a conversation between two devices, leveraging TCP connections through port 139/tcp. A session begins with a "Session Request" packet and can be established based on the response. The service supports larger messages, error detection, and recovery, with TCP handling flow control and packet retransmission.

Data transmission within a session involves Session Message packets, with sessions being terminated by closing the TCP connection.

These services are integral to NetBIOS functionality, enabling efficient communication and resource sharing across a network. For more information on TCP and IP protocols, refer to their respective TCP Wikipedia and IP Wikipedia pages.

    PORT      STATE SERVICE      VERSION
    139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn

Read the next page to learn how to enumerate this service:

137,138,139 - Pentesting NetBios

## HackTricks Automatic Commands

    Protocol_Name: Netbios    #Protocol Abbreviation if there is one.
    Port_Number:  137,138,139     #Comma separated if there is more than one.
    Protocol_Description: Netbios         #Protocol Abbreviation Spelled out

    Entry_1:
      Name: Notes
      Description: Notes for NetBios
      Note: |
        Name service for name registration and resolution (ports: 137/udp and 137/tcp).
        Datagram distribution service for connectionless communication (port: 138/udp).
        Session service for connection-oriented communication (port: 139/tcp).

        For a device to participate in a NetBIOS network, it must have a unique name. This is achieved through a broadcast process where a "Name Query" packet is sent. If no objections are received, the name is considered available. Alternatively, a Name Service server can be queried directly to check for name availability or to resolve a name to an IP address.

        https://book.hacktricks.wiki/en/network-services-pentesting/137-138-139-pentesting-netbios.html

    Entry_2:
      Name: Find Names
      Description: Three scans to find the names of the server
      Command: nmblookup -A {IP} &&&& nbtscan {IP}/30 &&&& nmap -sU -sV -T4 --script nbstat.nse -p 137 -Pn -n {IP}

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.