Beginner Guide NetBIOS and SMB Penetration Testing on Windows

From Wikipedia

NETBIOS (Network Basic Input/output System)

NETBIOS is a service which allows communication between applications such as printer or other computer in Ethernet or token ring network via NETBIOS name.

NETBIOS name is 16 digits long character assign to a computer in workgroup by WINS for name resolution of an IP address into NETBIOS name.

Workgroup VS Domain

Workgroup: It is a peer to peer network for maximum 10 computers in same LAN or subnet. It has no Centralized Administration, which means no computer has control over another computer. Each user controls the resources and security locally on their system.

Domain: It is a client/server network for up to 2000 computers anywhere in the world. The administrator manages the domain and its users and resources. A user with an account on the domain can log onto any computer system, without having the account on that computer.

NetBIOS provides three distinct services:

1. Name service (NetBIOS-NS) for name registration and resolution via port 137.
2. Datagram distribution service (NetBIOS-DGM) for connectionless communication via port 138.
3. Session service (NetBIOS-SSN) for connection-oriented communication via port 139. 

PortProtocolService135TCPMS-RPC endpoint mapper137UDPNetBIOS Name Service138UDPNetBIOS Datagram Service139TCPNetBIOS Session Service445TCPSMB ProtocolPort 135: it is used for Microsoft Remote Procedure Call between client and server to listen the query of client. Basically it is used for communication between client- client and server -client for sending messages.

Port 137: the name service operates on UDP port 137. The name service primitives offered by NetBIOS are:

• Add name – registers a NetBIOS name.
• Add group name – registers a NetBIOS “group” name.
• Delete name – un-registers a NetBIOS name or group name.
• Find name – looks up a NetBIOS name on the network.

Port 138: Datagram mode is connectionless; the application is responsible for error detection and recovery. In NBT, the datagram service runs on UDP port 138.The datagram service primitives offered by NetBIOS are:

• Send Datagram – send a datagram to a remote NetBIOS name.
• Send Broadcast Datagram – send a datagram to all NetBIOS names on the network.
• Receive Datagram – wait for a packet to arrive from a Send Datagram operation.
• Receive Broadcast Datagram – wait for a packet to arrive from a Send Broadcast Datagram operation.

Port 139: Session mode lets two computers establish a connection, allows messages to span multiple packets, and provides error detection and recovery. In NBT, the session service runs on TCP port 139.

The session service primitives offered by NetBIOS are:

• Call – opens a session to a remote NetBIOS name.
• Listen – listen for attempts to open a session to a NetBIOS name.
• Hang Up – close a session.
• Send – sends a packet to the computer on the other end of a session.
• Send No Ack – like Send, but doesn’t require an acknowledgment.
• Receive – wait for a packet to arrive from a Send on the other end of a session.

Port 445: It is used for SMB protocol (server message block) for sharing file between different operating system i.e. windows-windows, Unix-Unix and Unix-windows.

Full Article Read Here