How to Enumerate NetBIOS Shares with NBTScan & Nmap Scripting Engine « Null Byte :: WonderHowTo

NetBIOS is a service that allows for communication over a network and is often used to join a domain and legacy applications. It is an older technology but still used in some environments today. Since it is an unsecured protocol, it can often be a good starting point when attacking a network. Scanning for NetBIOS shares with NBTScan and theNmap Scripting Engineis a good way to begin.To run through this technique, we'll be usingMetasploitable 2, an intentionally vulnerable virtual machine, as our target machine. We will be attacking it withKali Linux, the go-to distro for hackers and pentesters alike.Overview of NetBIOSNetBIOS, which stands for network basic input/output system, is a service that allows computers to communicate over anetwork. However, NetBIOS is not a networking protocol, it is anAPI. It runs over TCP/IP via the NBT protocol, allowing it to function on modern networks.NetBIOS provides two primary communication methods. The datagram service allows for connectionless communication over a network, ideal for situations where fast transmission is preferred, such as error generation. The session service, on the other hand, allows two computers to establish a connection for reliable communication. NetBIOS also provides name services which allow forname resolutionand registration over the network.Related Reading:'Network Protocols Handbook' by Javvin PressThe primary way attackers exploit NetBIOS is throughpoisoning attacks, which occur when the attacker is on the network and spoofs another machine in order to control and misdirect traffic. An attacker can also obtain thehashed credentialsof a user at this point to crack later on.Scanning with NBTScanNBTScan is acommand linetool used for scanning networks to obtain NetBIOS shares and name information. It can run on both Unix and Windows and ships with Kali Linux by default.The first thing we can do is print the help, which will give us all the usage options and some examples for scanning networks. Simply typenbtscanat the prompt.nbtscanNBTscan version 1.5.1. Copyright (C) 1999-2003 Alla Bezroutchko.
This is a free software and it comes with absolutely no warranty.
You can use, distribute and modify it under terms of GNU GPL.

Usage:
nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename)|(<scan_range>)
	-v		verbose output. Print all names received
			from each host
	-d		dump packets. Print whole packet contents.
	-e		Format output in /etc/hosts format.
	-l		Format output in lmhosts format.
			Cannot be used with -v, -s or -h options.
	-t timeout	wait timeout milliseconds for response.
			Default 1000.
	-b bandwidth	Output throttling. Slow down output
			so that it uses no more that bandwidth bps.
			Useful on slow links, so that ougoing queries
			don't get dropped.
	-r		use local port 137 for scans. Win95 boxes
			respond to this only.
			You need to be root to use this option on Unix.
	-q		Suppress banners and error messages,
	-s separator	Script-friendly output. Don't print
			column and record headers, separate fields with separator.
	-h		Print human-readable names for services.
			Can only be used with -v option.
	-m retransmits	Number of retransmits. Default 0.
	-f filename	Take IP addresses to scan from file filename.
			-f - makes nbtscan take IP addresses from stdin.
	<scan_range>	what to scan. Can either be single IP
			like 192.168.1.1 or
			range of addresses in one of two forms:
			xxx.xxx.xxx.xxx/xx or xxx.xxx.xxx.xxx-xxx.
Examples:
	nbtscan -r 192.168.1.0/24
		Scans the whole C-class network.
	nbtscan 192.168.1.25-137
		Scans a range from 192.168.1.25 to 192.168.1.137
	nbtscan -v -s : 192.168.1.0/24
		Scans C-class network. Prints results in script-friendly
		format using colon as field separator.
		Produces output like that:
		192.168.0.1:NT_SERVER:00U
		192.168.0.1:MY_DOMAIN:00G
		192.168.0.1:ADMINISTRATOR:03U
		192.168.0.2:OTHER_BOX:00U
		...
	nbtscan -f iplist
		Scans IP addresses specified in file iplist.The most basic way to run this tool is to give it a range of IP addresses. In this case, there is only one machine on the network so I will give its IP address as an example.nbtscan 172.16.1.102Doing NBT name scan for addresses from 172.16.1.102

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
172.16.1.102     METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00Here, we can see the IP address, the NetBIOS display name, the server if applicable, the user, and theMAC addressof the target. Please note that machines runningSambawill sometimes return all zeros as the MAC address in response to the query.We can get a little more information by setting verbose output with the-vflag.nbtscan 172.16.1.102 -vDoing NBT name scan for addresses from 172.16.1.102

NetBIOS Name Table for Host 172.16.1.102:

Incomplete packet, 335 bytes long.
Name             Service          Type
----------------------------------------
METASPLOITABLE   <00>             UNIQUE
METASPLOITABLE   <03>             UNIQUE
METASPLOITABLE   <20>             UNIQUE
METASPLOITABLE   <00>             UNIQUE
METASPLOITABLE   <03>             UNIQUE
METASPLOITABLE   <20>             UNIQUE
__MSBROWSE__  <01>              GROUP
WORKGROUP        <00>              GROUP
WORKGROUP        <1d>             UNIQUE
WORKGROUP        <1e>              GROUP
WORKGROUP        <00>              GROUP
WORKGROUP        <1d>             UNIQUE
WORKGROUP        <1e>              GROUP

Adapter address: 00:00:00:00:00:00
----------------------------------------We can see some services and their types. This is sort of jumbled, which brings us to the next option, which will print the services in human-readable form. Use the-hflag along with the-voption.nbtscan 172.16.1.102 -vhDoing NBT name scan for addresses from 172.16.1.102

NetBIOS Name Table for Host 172.16.1.102:

Incomplete packet, 335 bytes long.
Name             Service          Type
----------------------------------------
METASPLOITABLE   Workstation Service
METASPLOITABLE   Messenger Service
METASPLOITABLE   File Server Service
METASPLOITABLE   Workstation Service
METASPLOITABLE   Messenger Service
METASPLOITABLE   File Server Service
__MSBROWSE__  Master Browser
WORKGROUP        Domain Name
WORKGROUP        Master Browser
WORKGROUP        Browser Service Elections
WORKGROUP        Domain Name
WORKGROUP        Master Browser
WORKGROUP        Browser Service Elections

Adapter address: 00:00:00:00:00:00
----------------------------------------Now we can see a bit more information that might prove to be useful. We can also set the-dflag to dump the contents of the entire packet.nbtscan 172.16.1.102 -dDoing NBT name scan for addresses from 172.16.1.102

Packet dump for Host 172.16.1.102:

Incomplete packet, 335 bytes long.
Transaction ID: 0x00a0 (160)
Flags: 0x8400 (33792)
Question count: 0x0000 (0)
Answer count: 0x0001 (1)
Name service count: 0x0000 (0)
Additional record count: 0x0000 (0)
Question name:  CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Question type: 0x0021 (33)
Question class: 0x0001 (1)
Time to live: 0x00000000 (0)
Rdata length: 0x0119 (281)
Number of names: 0x0d (13)
Names received:
METASPLOITABLE    Service: 0x00 Flags: 0x0004
METASPLOITABLE    Service: 0x03 Flags: 0x0004
METASPLOITABLE    Service: 0x20 Flags: 0x0004
METASPLOITABLE    Service: 0x00 Flags: 0x0004
METASPLOITABLE    Service: 0x03 Flags: 0x0004
METASPLOITABLE    Service: 0x20 Flags: 0x0004
__MSBROWSE__   Service: 0x01 Flags: 0x0084
WORKGROUP         Service: 0x00 Flags: 0x0084
WORKGROUP         Service: 0x1d Flags: 0x0004
WORKGROUP         Service: 0x1e Flags: 0x0084
WORKGROUP         Service: 0x00 Flags: 0x0084
WORKGROUP         Service: 0x1d Flags: 0x0004
WORKGROUP         Service: 0x1e Flags: 0x0084

...This provides packet data used in the query. Note that this cannot be used with the-vor-hoptions.If you have a list of IP addresses you wish to scan stored in a file, the-fflag can be used to specify the input file to read from. Again, in this case, there is only one machine on the network so only that one shows up during our scan.nbtscan -f addresses.txtDoing NBT name scan for addresses from addresses.txt

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
172.16.1.102     METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00Conversely, if we wanted to store the output of any scan, simply append the name of the file we want to write to.nbtscan 172.16.1.102 > scan.txtScanning with Nmap Scripting EngineNmapcontains a handy little script as part of theNmap Scripting Enginethat we can also use to discover NetBIOS shares. This has the advantage that it can be ran with other NSE scripts, ultimately saving time when enumerating many different things on a network.We will run Nmap in the usual way, and thenbstatscript will complete at the end. Here, I am using the-sVoption to probe ports for running services and their version, along with the-vflag for verbose output. Specify the script to use and we are good to go.nmap -sV 172.16.1.102 --script nbstat.nse -vStarting Nmap 7.70 ( https://nmap.org ) at 2019-02-14 14:12 CST
NSE: Loaded 44 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 14:12
Completed NSE at 14:12, 0.00s elapsed
Initiating NSE at 14:12
Completed NSE at 14:12, 0.00s elapsed
Initiating ARP Ping Scan at 14:12
Scanning 172.16.1.102 [1 port]
Completed ARP Ping Scan at 14:12, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 14:12
Completed Parallel DNS resolution of 1 host. at 14:12, 13.00s elapsed
Initiating SYN Stealth Scan at 14:12
Scanning 172.16.1.102 [1000 ports]

...

Host script results:
| nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| Names:
|   METASPLOITABLE<00>   Flags: <unique><active>
|   METASPLOITABLE<03>   Flags: <unique><active>
|   METASPLOITABLE<20>   Flags: <unique><active>
|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
|   WORKGROUP<00>        Flags: <group><active>
|   WORKGROUP<1d>        Flags: <unique><active>
|_  WORKGROUP<1e>        Flags: <group><active>Nmap starts and runs the usual scanning, and then near the end, we can finally see the host script results. This appears similar to one of the scans we ran earlier, but it never hurts to be knowledgeable of different ways to accomplish the same task.How to Prevent NetBIOS EnumerationFortunately for all the administrators out there, there is a pretty easy solution to protect against unauthorized scanning of NetBIOS shares, and that is to simply disable NetBIOS. There are some scenarios where disabling this could break things, such as when certain legacy applications completely depend on it, but more often than not there will be better solutions available and it will be fine to disable it.If you absolutely need to have NetBIOS enabled, be aware of common default naming conventions. On certain versions of WindowsC$orADMIN$are common names and should be avoided if possible. The good news for all you hackers out there is you can be aware and look for these.Wrapping UpIn this tutorial, we learned about the NetBIOS service and how it could be leveraged into an attack. We performed scanning to enumerate open shares with NBTScan, a simple command line tool, and then learned how to use an Nmap script to do the same. NetBIOS may be an older technology, but it is still found in corporate environments today. It can often be a good jumping off point afterrecon, so it's good to know how to identify it.More Information on NetBIOS:'Inside NetBIOS' by J. Scott HaugdahlFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byBrett Sayles/PexelsRelatedHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Enumerate SMB with Enum4linux & SmbclientHow To:Get Started Writing Your Own NSE Scripts for NmapAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Easily Detect CVEs with Nmap ScriptsHow To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!Hack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHacking macOS:How to Spread Trojans & Pivot to Other Mac ComputersHack Like a Pro:Scripting for the Aspiring Hacker, Part 2 (Conditional Statements)Hack Like a Pro:The Ultimate List of Hacking Scripts for Metasploit's MeterpreterHow To:Identify Web Application Firewalls with Wafw00f & NmapHow To:Quickly Look Up the Valid Subdomains for Any WebsiteHow To:Perform Network-Based Attacks with an SBC ImplantHow To:Tactical Nmap for Beginner Network ReconnaissanceHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Hack a NETBIOS IPC$ shareHack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1Dissecting Nmap:Part 1How To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)How To:Hack UnrealIRCd Using Python Socket ProgrammingHow To:Find & Exploit SUID Binaries with SUID3NUMHow To:Use LinEnum to Identify Potential Privilege Escalation VectorsHack Like a Pro:How to Scan the Globe for Vulnerable Ports & ServicesHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapWeekend Homework:How to Become a Null Byte ContributorHow To:Bash (Shell) Scripting for BeginnersNews:Null Byte Is Calling for Contributors!How To:Use the Nmap security toolCryEngine 3:Now Everyone Can Make a Game As Good As Crysis 2… For FreeHow To:Cheat Engine for FarmVille - The Definitive Guide