312-50V11 · Question #652
Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network?
The correct answer is D. 139 and 445. Null sessions on Windows NT/2000 systems operate over NetBIOS and SMB, requiring TCP/UDP ports 139 and 445 to be filtered to block unauthenticated IPC$ connections.
Question
Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Which TCP and UDP ports must you filter to check null sessions on your network?
Options
- A137 and 139
- B137 and 443
- C139 and 443
- D139 and 445
How the community answered
(56 responses)- A2% (1)
- B5% (3)
- C2% (1)
- D91% (51)
Why each option
Null sessions on Windows NT/2000 systems operate over NetBIOS and SMB, requiring TCP/UDP ports 139 and 445 to be filtered to block unauthenticated IPC$ connections.
Port 137 is the NetBIOS Name Service used for name resolution queries, not for establishing session-layer null session connections; it is not sufficient to filter alongside 139.
Port 443 is HTTPS and is entirely unrelated to NetBIOS or SMB null session traffic.
Port 443 (HTTPS) plays no role in null session attacks; the correct pairing is 139 (NetBIOS Session Service) and 445 (SMB).
Port 139 (NetBIOS Session Service) and port 445 (Direct Hosted SMB over TCP/IP) are both used by Windows to accept SMB connections, including anonymous null sessions to the IPC$ share. Filtering both ports is necessary because Windows systems can use either path to establish these unauthenticated connections, and leaving either open allows null session enumeration.
Concept tested: Null session ports filtering on Windows networks
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/prevent-null-session-connections-to-ipc-share
Topics
Community Discussion
No community discussion yet for this question.