gabrielmoreira Pentesting NetBIOS (ports 137/138/139)
When to Use
- During authorized internal network assessments when UDP 137, UDP 138, or TCP 139 is reachable
- When mapping Windows hosts on a LAN by NetBIOS name, workgroup/domain, and MAC address
- When TCP 445 is filtered but 139 is open (SMB over NetBIOS still works)
- As an early reconnaissance step before SMB/Active Directory enumeration
- When investigating NBT-NS/LLMNR poisoning opportunities for credential capture
Quick Enumeration
# Names the server uses + MAC address (Name Service, 137)
nmblookup -A <IP>
nbtscan <IP>/30
nbtscan -r 192.168.0.1/24 # scan a /24 quickly
sudo nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n <IP>
# Session service banner (139) — confirms SMB-over-NetBIOS
nmap -p139 -sV <IP>
# Expected: 139/tcp open netbios-ssn Microsoft Windows netbios-ssn
# Name service banner (137/udp)
# Expected: 137/udp open netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)
Critical: Checks Most Often Missed
- Workgroup vs domain disclosure — the NetBIOS name table reveals the workgroup or NT domain (
<1C>/<00>group entries), giving you the AD/workgroup name for free before touching SMB. - MAC address leak —
nbtscan/nbstatreturn the server MAC, useful for vendor fingerprinting and pivoting. - Unique vs group name suffixes — suffix bytes identify roles:
<00>workstation,<20>File Server (SMB enabled),<1B>Domain Master Browser (often the PDC),<1C>Domain Controllers group. A<20>means the host serves SMB — pivot to share enumeration. - SMB still reachable on 139 — if 445 is filtered, 139 (NBT over IP) frequently still exposes the full SMB attack surface. Point your SMB tooling at port 139.
- NBT-NS poisoning surface — broadcast name resolution on 137/udp can be poisoned with Responder to capture NetNTLM hashes on the segment.
How to CONFIRM: NetBIOS is confirmed when nmblookup -A <IP> returns a name table (lines with <XX> suffixes) or nbtscan lists the name and MAC. A <20> suffix confirms the host runs an SMB file server reachable over 139.
Workflow
Step 1: Enumerate (names, workgroup/domain, MAC)
# Resolve the name table for a single host
nmblookup -A <IP>
# Read the suffixes:
# <00> UNIQUE -> workstation / hostname
# <00> GROUP -> workgroup / domain name
# <20> UNIQUE -> SMB file server service running
# <1B> UNIQUE -> Domain Master Browser (likely PDC)
# <1C> GROUP -> Domain Controllers
# <1D> UNIQUE -> Master Browser
# Sweep a subnet for live NetBIOS hosts
nbtscan -r 192.168.0.0/24
sudo nmap -sU --script nbstat.nse -p137 -Pn -n 192.168.0.0/24
Step 2: Identify roles and reachable SMB
# Confirm session service (SMB over NetBIOS) on 139
nmap -p139,445 -sV <IP>
# If 445 is filtered but 139 is open, drive SMB tooling at 139
smbclient -p 139 --no-pass -L //<IP>
smbmap -P 139 -H <IP>
rpcdump.py -port 139 [[domain/]username[:password]@]<IP> # map RPC endpoints over 139
Step 3: Pivot to SMB enumeration
# Once a <20> (file server) host is found, enumerate shares/users over NetBIOS
enum4linux-ng -A <IP>
smbclient --no-pass -L //<IP>
crackmapexec smb <IP> --port 139 -u '' -p '' --shares
# See the pentesting-smb skill for full share/user/credential workflow
Step 4: Name-service poisoning (capture credentials)
# Poison broadcast NBT-NS/LLMNR requests to capture NetNTLM hashes
sudo responder -I <iface> -wv
# Crack captured hashes offline or relay (see SMB relay in pentesting-smb)
hashcat -m 5600 captured_netntlmv2.txt wordlist.txt
Key Concepts
| Concept | Description |
|---|---|
| Name Service (137) | Registers and resolves NetBIOS names; queried to obtain names and MAC (137/udp and 137/tcp) |
| Datagram Service (138) | Connectionless communication and broadcast messaging (138/udp) |
| Session Service (139) | Connection-oriented service carrying SMB over NetBIOS (139/tcp) |
| NetBIOS name | Up to 16 characters; the 16th byte is a suffix identifying the service/role |
| Name suffixes | <00> workstation/workgroup, <20> file server, <1B> domain master browser, <1C> DC group |
| NBT over IP vs SMB over IP | Port 139 is NBT over IP; port 445 is SMB directly over TCP/IP |
| NBT-NS poisoning | Spoofing broadcast name responses to capture NetNTLM authentication |
Tools & Systems
| Tool | Purpose |
|---|---|
| nmblookup | Resolve a host's NetBIOS name table and roles (-A <IP>) |
| nbtscan | Fast subnet sweep returning NetBIOS names and MAC addresses |
| nmap (nbstat.nse) | Scriptable name-table enumeration over UDP 137 |
| enum4linux-ng | Aggregated NetBIOS/SMB enumeration once a file server is found |
| smbclient / smbmap | SMB access over port 139 when 445 is filtered |
| Responder | NBT-NS/LLMNR poisoning to capture NetNTLM hashes |
| impacket rpcdump.py | Map MSRPC endpoints over NetBIOS (port 139) |
Common Scenarios
Scenario 1: Domain Discovery on a Flat LAN
nbtscan -r 10.0.0.0/24 returns each host's NetBIOS name and a <1C> group entry exposing the AD domain name, immediately scoping the Active Directory environment.
Scenario 2: 445 Filtered, 139 Open
A hardened host blocks 445 but leaves 139 open. Pointing smbclient -p 139 --no-pass -L //<IP> at the session service still enumerates shares, bypassing the partial filtering.
Scenario 3: File Server Identification
nmblookup -A <IP> shows a <20> suffix, confirming the host runs an SMB file server. The tester pivots to share enumeration and finds a readable backup share.
Scenario 4: Credential Capture via NBT-NS
Responder answers broadcast NetBIOS name queries for mistyped hostnames, capturing NetNTLMv2 hashes that are cracked offline to recover a domain user password.
Output Format
## NetBIOS Finding
**Service**: NetBIOS over TCP/IP
**Severity**: <Medium|Low|Informational>
**Host**: <IP> (137/udp, 138/udp, 139/tcp)
### Summary
<What was disclosed: hostname, workgroup/domain, MAC, file-server role, poisoning exposure>
### Name Table
| Name | Suffix | Type | Meaning |
|------|--------|------|---------|
| WIN-DC01 | <00> | UNIQUE | Hostname |
| CORP | <1C> | GROUP | Domain Controllers (domain = CORP) |
| WIN-DC01 | <20> | UNIQUE | SMB file server active |
MAC address: <xx:xx:xx:xx:xx:xx>
### Evidence
- Command: nmblookup -A <IP>
- Output: <name table excerpt>
### Recommendation
1. Disable NetBIOS over TCP/IP where not required (use DNS/SMB direct on 445)
2. Disable LLMNR and NBT-NS broadcast resolution to prevent poisoning
3. Restrict 137-139 to trusted management segments
4. Enable SMB signing to mitigate relay of captured NetNTLM hashes