GPEN · Question #380
Which of the following ports must you filter to check null sessions on your network?
The correct answer is A. 139 and 445. Null sessions are anonymous SMB connections to Windows systems that are established over port 139 (NetBIOS Session Service) and port 445 (SMB over TCP/IP); filtering both is required to block them.
Question
Which of the following ports must you filter to check null sessions on your network?
Options
- A139 and 445
- B111 and 222
- C1234 and 300
- D130 and 200
How the community answered
(47 responses)- A83% (39)
- B4% (2)
- C2% (1)
- D11% (5)
Why each option
Null sessions are anonymous SMB connections to Windows systems that are established over port 139 (NetBIOS Session Service) and port 445 (SMB over TCP/IP); filtering both is required to block them.
Null sessions exploit Windows SMB null authentication, enabling anonymous enumeration of users, groups, shares, and security policies. Port 139 carries NetBIOS Session Service traffic and port 445 carries SMB directly over TCP, so both must be filtered to prevent null session establishment on a network.
Port 111 is the ONC RPC portmapper and port 222 has no standard association with Windows SMB or null session protocols.
Ports 1234 and 300 are not assigned to any Windows networking service related to null sessions or SMB.
Ports 130 and 200 are not defined NetBIOS or SMB ports and have no relationship to null session attacks.
Concept tested: Null session filtering via SMB and NetBIOS ports
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting-of-smb-over-tcpip
Topics
Community Discussion
No community discussion yet for this question.