abelrguezr NetBIOS Enumeration
Overview
NetBIOS provides three core services for network communication:
| Service | Port | Protocol | Purpose |
|---|---|---|---|
| Name Service | 137 | UDP/TCP | Name registration and resolution |
| Datagram Distribution | 138 | UDP | Connectionless communication |
| Session Service | 139 | TCP | Connection-oriented communication |
Quick Start
# Enumerate NetBIOS names and MAC addresses
nmblookup -A <IP>
# Scan a subnet for NetBIOS hosts
nbtscan <IP>/30
# Nmap enumeration with nbstat script
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>
Detailed Enumeration
Name Service (Port 137)
The Name Service handles name registration and resolution. Devices participate in a NetBIOS network through a broadcast process where "Name Query" packets are sent. If no objections are received, the name is considered available.
Commands:
# Query a specific host for NetBIOS names
nmblookup -A <IP>
# Scan a subnet range
nbtscan <IP>/30
# Nmap with nbstat.nse script (most comprehensive)
nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>
What you'll discover:
- Computer/Server names
- Workgroup or domain membership
- MAC address of the network interface
- User names (sometimes visible)
- NetBIOS service types
Datagram Distribution Service (Port 138)
NetBIOS datagrams allow for connectionless communication via UDP, supporting direct messaging or broadcasting to all network names.
Check if open:
nmap -sU -p138 <IP>
Session Service (Port 139)
The Session Service facilitates connection-oriented interactions between two devices using TCP. A session begins with a "Session Request" packet and supports larger messages, error detection, and recovery.
Check if open:
nmap -sT -p139 <IP>
What to Look For
When enumerating NetBIOS, pay attention to:
- Computer names - The NetBIOS name of the target system
- Workgroup/Domain - Network membership information
- MAC address - Physical network interface identifier
- Service types - What NetBIOS services are running
- User accounts - Sometimes visible in enumeration output
Common Nmap Findings
PORT STATE SERVICE VERSION
137/udp open netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)
138/udp open|filtered netbios-dgm
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
Next Steps After Enumeration
Once you've enumerated NetBIOS services, consider:
- Check SMB vulnerabilities - Port 445 often accompanies NetBIOS
- Attempt null sessions - Anonymous SMB connections
- Look for password hashes - LanMan/NTLM hashes may be accessible
- Investigate share access - Enumerate and access network shares
- Check for misconfigurations - Anonymous access, weak permissions
Automation Script
For repeated enumeration tasks, use the bundled script:
./scripts/netbios-enumerate.sh <IP>
This runs all three enumeration methods and saves results to a file.