GPEN · Question #25
Which TCP and UDP ports can be used to start a NULL session attack in NT and 2000 operating systems?
The correct answer is A. 139 and 445. NULL sessions in Windows NT and 2000 allow anonymous connections to the IPC$ share over NetBIOS and SMB ports to enumerate users, shares, and system info. Ports 139 and 445 are the specific TCP ports used to establish these unauthenticated sessions.
Question
Which TCP and UDP ports can be used to start a NULL session attack in NT and 2000 operating systems?
Options
- A139 and 445
- B149 and 133
- C203 and 333
- D198 and 173
How the community answered
(22 responses)- A77% (17)
- B14% (3)
- C5% (1)
- D5% (1)
Why each option
NULL sessions in Windows NT and 2000 allow anonymous connections to the IPC$ share over NetBIOS and SMB ports to enumerate users, shares, and system info. Ports 139 and 445 are the specific TCP ports used to establish these unauthenticated sessions.
Port 139 is the NetBIOS Session Service port used by older Windows networking for file and printer sharing, while port 445 is the SMB/Microsoft-DS port introduced in Windows 2000 that allows SMB to run directly over TCP/IP. NULL session attacks exploit anonymous access to the IPC$ share over these ports, allowing an attacker to enumerate user accounts, group memberships, and shared resources without any credentials.
Ports 149 and 133 are not assigned to NetBIOS or SMB services and play no role in Windows NULL session establishment.
Ports 203 and 333 are not standard Windows file sharing or session protocol ports and are unrelated to NULL session attacks.
Ports 198 and 173 are not associated with any Windows networking protocol used in NULL session attacks.
Concept tested: NULL session attack ports in Windows NT/2000
Topics
Community Discussion
No community discussion yet for this question.