4.2 SMB NetBIOS Enumeration

Summary

This video explains the concepts of NetBIOS and SMB (Server Message Block), detailing their historical context, usage, and differences. NetBIOS, initially a layer 5 session protocol for name resolution and file sharing, evolved with Microsoft’s adoption of TCP/IP, leading to NetBIOS over TCP (NBT). SMB, the modern protocol for file and print sharing, integrates with NetBIOS for legacy support. The video covers SMB’s transition from relying on NetBIOS to running directly over TCP, its vulnerabilities, and various tools for enumerating and exploiting these services, including commands and utilities for both Windows and Linux systems.

Takeaways

• 😀 NetBIOS stands for Network Basic Input Output System and is a session-layer protocol and API used for name resolution and communication in early Microsoft small LANs.
• 😀 NetBIOS names are limited to 1-15 characters, can only use letters, numbers, and a few special characters like a dash, and must start with a letter.
• 😀 When Microsoft adopted TCP/IP, it bolted NetBIOS on top, resulting in NetBIOS over TCP (NetBT), which uses TCP and UDP ports 137-139 for communication.
• 😀 SMB (Server Message Block) is the modern protocol used for file and print sharing on Microsoft machines, and it operates using hidden shares like IPC$ for inter-process communication.
• 😀 Initially, SMB depended on NetBIOS for network communication, but by Windows 2000, SMB began running directly over TCP (on port 445), eliminating the need for NetBIOS.
• 😀 NetBIOS can still be used for backward compatibility in some networks, including those with Linux and Unix systems running Samba (which mimics SMB).
• 😀 NetBIOS and SMB are both prone to security vulnerabilities, particularly those affecting file and print servers and allowing attackers to enumerate network information.
• 😀 NetBIOS tools like `NBTStat` and `Net` commands can be used for enumeration to gather details such as computer names, users, shares, and password policy information.
• 😀 The 'IPC$' share is a hidden network share used for communication between processes, and attackers can exploit it by using null user connections to gain access.
• 😀 Legacy Windows systems and certain settings still allow null user connections for enumerating NetBIOS information, which can be exploited by attackers using tools like `Net Use` and `NBTStat`.
• 😀 Various network enumeration tools, including `enum4linux`, `ShareEnum`, and `SuperScan`, are available for gathering SMB and NetBIOS information, including hidden shares and user lists.

Q & A

What does NetBIOS stand for and what role does it play in networking?

NetBIOS stands for Network Basic Input/Output System. It is a session layer protocol and API used primarily for name resolution and file sharing over small local area networks (LANs). It allows computers to communicate with each other by broadcasting NetBIOS names, using a specific naming convention with limitations on character types.

What are the limitations of NetBIOS names?

NetBIOS names are restricted to letters and numbers, with a requirement to start with a letter. Special characters that are allowed include a dash, a dot, an underscore, and a dollar sign. The names can be 1 to 15 characters long, with an additional hidden 16th character used to indicate the type of name, such as a host or domain name.

How does NetBIOS interact with DNS naming conventions?

NetBIOS naming conventions are incompatible with some DNS naming rules. For instance, the dot (.) in DNS denotes hierarchy, which should not be used in a NetBIOS name. The underscore is reserved for service records in DNS, and the dollar sign is illegal. Only the dash is fully compatible with DNS for host names.

What is the relationship between SMB and NetBIOS?

Originally, SMB (Server Message Block) relied on NetBIOS for communication over networks, with SMB running over NetBIOS over TCP (NBT). However, starting with Windows 2000, SMB was able to communicate directly over TCP, eliminating the need for NetBIOS as an intermediary. Despite this, NetBIOS is still used for backward compatibility.

What is the role of the IPC$ share in SMB?

The IPC$ (Inter-Process Communication) share is a hidden network share that allows communication between processes on different machines. It enables them to interact simultaneously and is not visible during normal network browsing but can be accessed manually.

Why is SMB sometimes used over NBT (NetBIOS over TCP/IP)?

SMB was initially implemented over NBT (NetBIOS over TCP/IP) to improve networking capabilities for file sharing and communication. Over time, however, SMB evolved to work directly over TCP, starting from Windows 2000, as it was more efficient without the extra layer of NetBIOS.

What is Samba and how does it relate to SMB?

Samba is a software suite that implements SMB on UNIX and Linux systems, allowing them to act as file and print servers in a way similar to Windows machines. Samba is essentially a reverse-engineered version of SMB, enabling interoperability between Linux/Unix and Windows environments.

What kind of information can be enumerated using NetBIOS and SMB tools?

Using NetBIOS and SMB enumeration tools, you can gather a wide range of information, including computer names, shared resources, users, logon information, password policies, Active Directory details, and network time. Additionally, tools like NBTstat and Net commands can retrieve server statistics, name cache, and more.

What is the vulnerability associated with the IPC$ share?

A vulnerability exists where attackers can exploit the IPC$ share to gain access to network information. By making a null connection (with no username or password), attackers can enumerate network names and access hidden shares, posing a potential security risk.

What tools can be used for SMB and NetBIOS enumeration?

There are several tools available for SMB and NetBIOS enumeration, including NBTstat, Net commands, enump for Linux, ShareEnum, SuperScan, and others like NetBIOS Enumerator and NS Auditor. These tools can help retrieve information about shares, users, machines, and more, providing valuable data for network administration or security analysis.