312-50V10 · Question #929
Allen, a professional pen tester, was hired by xpertTech solutWns to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS API a
The correct answer is C. <03>. NetBIOS name codes (suffixes) identify the specific service associated with a registered NetBIOS name. The code <03> (hex) is registered by the Messenger Service and is tied to the currently logged-in username on the machine - it enables delivery of net send / pop-up messages to
Question
Allen, a professional pen tester, was hired by xpertTech solutWns to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS API and targeted the NetBIOS service. B/enumerating NetBIOS, he found that port 139 was open and could see the resources that could be accessed or viewed on a remote system. He came across many NetBIOS codes during enumeration. Identify the NetBIOS code used for obtaining the messenger service running for the logged-in user?
Options
- A<1B>
- B<00>
- C<03>
- D<20>
How the community answered
(40 responses)- A3% (1)
- B3% (1)
- C88% (35)
- D8% (3)
Explanation
NetBIOS name codes (suffixes) identify the specific service associated with a registered NetBIOS name. The code <03> (hex) is registered by the Messenger Service and is tied to the currently logged-in username on the machine - it enables delivery of net send / pop-up messages to a specific user. Key codes to know: <00> = Workstation Service (computer name); <03> = Messenger Service (logged-in user); <1B> = Domain Master Browser; <20> = File Server Service (SMB file sharing). During NetBIOS enumeration on open port 139, seeing a <03> entry reveals the username of the currently logged-in user, which is valuable reconnaissance data for an attacker.
Topics
Community Discussion
No community discussion yet for this question.