GPEN · Question #271
Which of the following ports is used for NetBIOS null sessions?
The correct answer is B. 139. NetBIOS Session Service operates on TCP port 139 and is the port used to establish NetBIOS null sessions, which allow unauthenticated anonymous connections to Windows resources. Ports 137 and 138 serve NetBIOS Name Service and Datagram Service respectively.
Question
Which of the following ports is used for NetBIOS null sessions?
Options
- A130
- B139
- C143
- D131
How the community answered
(29 responses)- A3% (1)
- B83% (24)
- C10% (3)
- D3% (1)
Why each option
NetBIOS Session Service operates on TCP port 139 and is the port used to establish NetBIOS null sessions, which allow unauthenticated anonymous connections to Windows resources. Ports 137 and 138 serve NetBIOS Name Service and Datagram Service respectively.
Port 130 is not assigned to any NetBIOS service; the three NetBIOS ports are 137 (Name Service), 138 (Datagram Service), and 139 (Session Service).
TCP port 139 is the NetBIOS Session Service port, and null sessions are established over this port by connecting anonymously without credentials using the IPC$ share (e.g., 'net use \\target\IPC$ "" /u:""'). This vulnerability historically allowed attackers to enumerate users, shares, and other sensitive information from Windows systems. Null session exploitation over port 139 was a significant attack vector before later Windows versions restricted anonymous access by default.
Port 143 is assigned to IMAP (Internet Message Access Protocol) for email retrieval, and has no association with NetBIOS or null sessions.
Port 131 is not a standard NetBIOS port and is not used for null sessions or any other NetBIOS function.
Concept tested: NetBIOS null session port and attack surface
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting-of-smb-over-tcpip
Topics
Community Discussion
No community discussion yet for this question.