SMB
What is SMB?
Server Message Block (SMB) is a common protocol for file sharing and inter-process communication on Windows and compatible systems. SMB has had many security issues in the past, and older versions (especially SMBv1) are insecure. Modern Windows improves SMB, but many networks still support legacy features like NetBIOS. Treat results from scans as leads, not absolute truth.
Key points
Ports
SMB (direct over TCP): 445
NetBIOS session: 139
NetBIOS name service: UDP 137
NetBIOS vs SMB
NetBIOS is a separate session-layer service used historically for name and session services.
NetBIOS over TCP (NBT) allows older SMB implementations to work over TCP/IP.
SMB can run without NetBIOS, but both are often enabled together for backward compatibility.
SMB versions
SMBv1 is old and insecure; many systems disable it today. If SMBv1 is enabled, additional enumeration techniques may work.
SMB Enumeration
Linux
Using Nmap
Find hosts with SMB/NetBIOS
Using scripts for more enumeration
You can specify any of those scripts by (which work for any other script type) :
You will see this later, message signing enabled and required indicates most of the time that this is a Domain controller, check AD Architecture for more.
SMBv1 checks: Some discovery techniques only work if SMBv1 is enabled.
Using "nbtscan"
Collecting NetBIOS Names (Works only if UDP/137 is opened)
Windows
Using 'net view' command
From a Windows machine, use built-in commands to list shares and resources. By providing the /all keyword, we can list the administrative shares ending with the dollar sign.
Last updated
Was this helpful?