SMB and NetBIOS Enumeration Techniques

Published on January 17, 2025

Understanding SMB and NetBIOS

What is SMB?

The Server Message Block (SMB) protocol is a network protocol used for sharing files, printers, and resources between devices. Operating over TCP port 445, SMB is deeply integrated into Windows environments and often coupled with Active Directory. While crucial for resource sharing, SMB has a history of vulnerabilities, including those exploited by attacks like EternalBlue.

What is NetBIOS?

NetBIOS (Network Basic Input/Output System) is a session-layer protocol facilitating communication between devices on local networks. It uses UDP ports 137 and 138, as well as TCP port 139. While modern SMB implementations can operate without NetBIOS, it remains enabled in many environments for backward compatibility.

Enumeration Tools and Techniques

1. Nmap for SMB and NetBIOS

Nmap is a versatile tool for enumerating SMB and NetBIOS services. Here are some useful commands:

  • Scan SMB and NetBIOS Ports: 
    nmap -v -p 139,445 <target-IP-range>
  • Discover OS and Domain Information: 
    nmap --script smb-os-discovery -p 139,445 <target-IP>
  • Enumerate SMB Shares: 
    nmap --script smb-enum-shares -p 445 <target-IP>

2. nbtscan for NetBIOS

nbtscan is a specialized tool for querying NetBIOS services and retrieving valuable information like NetBIOS names: 

sudo nbtscan -r <target-subnet>

Example Output: 


IP address       NetBIOS Name     Server
192.168.50.124   SAMBA            <server>

3. Windows Commands

From a Windows client, the net view command lists shared resources on a remote host: 

net view \\<hostname> /all

Key Takeaways

  • SMB and NetBIOS Ports: Focus on TCP ports 445 and 139, and UDP ports 137 and 138.
  • Tools: Use Nmap for scanning and nbtscan for detailed NetBIOS information.
  • Modern Considerations: Disable SMBv1 and ensure proper configurations for better security.

By leveraging tools like Nmap and nbtscan, you can effectively enumerate SMB and NetBIOS services, uncover shared resources, and identify potential vulnerabilities. Always follow ethical and legal guidelines during your assessments.

Linked Articles