NetBIOS Pentest
A basic primer on NetBIOS enumeration and exploitation
Attackers use the NetBIOS enumeration to obtain:
The list of computers that belong to a domain
The list of shares on the individual hosts in the network
Policies and passwords
Enumeration
Using nbtstat
utility in Windows
nbtstat
utility in WindowsThe nbtstat
utility in Windows displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables for both the local and remote computers, and the NetBIOS name cache.
Get the NetBIOS name table of a remote computer
Using the -a flag all the records in the NetBIOS name list using the remote hostname or NetBIOS name of the computer/target in the NetBIOS network.
Using the -A
flag we can dump all records in the NetBIOS name list using the IP address of the target. It can be used interchangeably with the -a
flag.
The common NetBIOS Codes are:
Name | NetBIOS Code | Type | Information Obtained |
---|---|---|---|
<host name> | <00> | UNIQUE | Hostname |
<domain> | <00> | GROUP | Domain name |
<host name> | <03> | UNIQUE | Messenger service running for the computer |
<user name> | <03> | UNIQUE | Messenger service running for the logged-in user |
<host name> | <20> | UNIQUE | Server service running |
<domain> | <1D> | GROUP | Master browser name for the subnet |
<domain> | <1B> | UNIQUE | Domain master browser name, which identifies the primary domain controller (PDC) for the domain |
<domain> | <1E> | GROUP | Browser service elections |
Fetch the contents/names in NetBIOS name cache
Display the names registered locally
The -n
flag displays the names registered locally by NetBIOS applications such as the server and redirector.
Count of all names resolved by a broadcast or WINS server
Purges the name cache and reloads all #PRE
-tagged entries from the Lmhosts
file
#PRE
-tagged entries from the Lmhosts
fileRelease and re-register all names with the name server
List the NetBIOS sessions
List the current NetBIOS sessions and their status with the IP addresses
List the NetBIOS sessions table converting destination IP addresses to computer NetBIOS names
Re-displays selected statistics, pausing at each display for the number of seconds specified in the interval
Using nmap
scripts
nmap
scriptsThe nbstat. nse script can be used for NetBIOS enumeration
Using net
tool on windows
net
tool on windowsView all available shares
In the above command <computername>
, is the name or IP address of a specific computer, the resources of which are to be displayed.
To view all available shares for the current host we can also use the share command.
Display all the shares in the domain
Display all the shares on the specified domain.
Listing Mapped Network Drives or available shares on the host:
The net use command is used to list the shared folder/drive available on the Windows Server.
Mapping a network drive
An example of this would be:
Mapping with different credentials
Disconnect a mapped drive
Using the NetBIOS enumerator GUI tool on Windows
NetBIOS enumerator is a GUI tool on Windows which can be used to enumerate NetBIOS names and
Exploitation
Last updated