Netbios
NetBIOS, which stands for Network Basic Input/Output System, is a fundamental networking concept primarily addressed in the Enumeration phase of hacking. Attackers often focus on NetBIOS first because it allows the extraction of a large amount of sensitive information about the target network.
💡 Definition and Core Function
NetBIOS was initially designed as an API (Application Programming Interface) for client software to access Local Area Network (LAN) resources*. In Windows environments, NetBIOS is used specifically for file and printer sharing*.
- NetBIOS Name: A NetBIOS name is a unique 16-character ASCII string used to identify network devices over TCP/IP.
- 15 characters are used for the device name.
- The 16th character (suffix/endchar) is reserved for the service or name record type.
🔌 NetBIOS Ports and Services
NetBIOS utilizes three primary ports via UDP and TCP protocols:
| Port/Protocol | Service Name | Description |
|---|---|---|
| UDP 137 | NETBIOS Name Service (NBNS) | Used for name resolution services. |
| UDP 138 | NETBIOS Datagram Service | Used for connectionless communication. |
| TCP 139 | NETBIOS Session Service | Used for SMB over NetBIOS session establishment, file transfer, and file/printer sharing. |
| TCP/UDP 445 | SMB over TCP (Direct Host) | Used by later versions of Windows (after 2000) for directly hosted SMB traffic, bypassing the older NetBIOS over TCP (NBT) protocol. |
The proper configuration of TCP port 139 is critical, and restricting access to this port should be a top priority for system administrators.
📝 NetBIOS Name Service (WINS)
The NetBIOS Name Service (NBNS) is also known as the Windows Internet Name Service (WINS). WINS maintains a database to match IP addresses with NetBIOS names and queries. Since attackers exploit this mapping process, the name service is often targeted first. Note that Microsoft does not support NetBIOS name resolution for IPv6.
🛠️ NetBIOS Enumeration Tools and Commands
Attackers use several methods and tools to perform NetBIOS enumeration:
- Nbtstat Utility: This built-in Windows utility is used to troubleshoot name resolution problems. The command
nbtstat -a <IP address>displays the NetBIOS name table of a remote computer. The commandnbtstat -cdisplays the contents of the NetBIOS name cache. - Nmap: The Nmap Scripting Engine (NSE), using the
nbstat.nsescript, retrieves the target's NetBIOS names and MAC addresses. - Net View: This command-line utility displays shared resources of a remote host or workgroup. For example,
net view \\<computername> /ALLdisplays all shares, including hidden ones. - Dedicated Tools: NetBIOS Enumerator (which enumerates names, usernames, domains, and MAC addresses), Global Network Inventory, Advanced IP Scanner, and Hyena.
- AI Automation: Attackers can leverage tools like ChatGPT to generate commands such as
nbtscan 10.10.1.11ornmblookup -A 10.10.1.11to automate the discovery process.
🛑 Countermeasures
Because a network running SMB (which historically relied on NetBIOS) is highly vulnerable to enumeration, key countermeasures include:
- Disabling SMB Protocol: It is advisable to disable the SMB protocol on Web and DNS Servers and other Internet-facing servers because they do not require it.
- Port Blocking: Block/disable the associated ports, specifically TCP 139 and TCP 445, and UDP 137 and 138.
- Restrict Anonymous Access: Restrict anonymous access by adding the
RestrictNullSessAccessparameter (set to 1 or enabled) to the Windows Registry. - SMB Version: Ensure all systems are using SMBv3 or higher to benefit from security enhancements like encryption, and avoid using SMBv1.