{"id":30258,"date":"2019-10-31T21:34:32","date_gmt":"2019-10-31T18:34:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/netbios-v-rukah-hakera\/"},"modified":"2019-10-31T21:34:32","modified_gmt":"2019-10-31T18:34:32","slug":"netbios-v-rukah-hakera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/netbios-v-rukah-hakera","title":{"rendered":"NetBIOS in the hands of a hacker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

This article will provide a brief narrative about what such an ordinary-looking thing as NetBIOS<\/i>can reveal for a potential attacker\/pentester.<\/a><\/noindex><\/p>\n

The demonstrated application area of reconnaissance techniques relates to internal, meaning isolated and inaccessible from the outside networks. Such networks are typically found in even the smallest companies.<\/p>\n

On its own, NetBIOS<\/i> it is generally used to obtain a network name. This will be enough to achieve at least four things.<\/p>\n

Host Discovery<\/b>
\nThanks to the fact that NetBIOS can use UDP as a transport, its speed allows for the discovery of hosts in very large networks. For example, the tool nbtscan<\/i>, which is part of the eponymous package, can resolve addresses in a network of the form 192.168.0.0\/16 in just 2 seconds (which can overload the network), whereas traditional TCP scanning would take dozens of minutes. This feature can be used as a host discovery technique (host sweep) in very large networks about which nothing is known before running nmap. Although the result does not guarantee 100% detection, as mainly Windows hosts will respond\u2014and not all of them\u2014it will still help determine the approximate ranges in which live hosts are present.<\/p>\n

Host Identification<\/b>
\nUsing the results obtained from names derived from IP addresses:<\/p>\n

\"NetBIOS
\n
\none can see: aside from the fact that the name reveals the owner of the workstation (though this is often not the case), one of the addresses stands out from the rest. We can see that the name KALI<\/i>was obtained. This behavior is typically characteristic of unix<\/i>-implementation SMB\/NetBIOS<\/i> as part of the software package samba<\/i> or very old Windows 2000.<\/i>.
\nName Retrieval KALI<\/i>, while on other hosts this <unknown<\/i>> indicates the presence of the so-called null-session.<\/i>Under default settings, SMB<\/i>-servers are inclined towards it. linux<\/i> Null-session allows for completely anonymous access (as we entered no passwords, as seen in the screenshot) to gather a considerable amount of additional information, such as local password policies, a list of local users, groups, and shared resources (shares):<\/i> Often on<\/p>\n

\"NetBIOS
\nlinux SMB. Linux SMB<\/i>-servers may have publicly accessible shares not just for reading but even for writing. The presence of both carries various threats, the use of which is beyond the scope of this article.<\/p>\n

NetBIOS<\/i> also allows you to obtain names of all types stored by the workstation:<\/p>\n

\"NetBIOS
\n
\nin this case, it allows you to know that the host is also a domain controller ARRIVA<\/i>.<\/p>\n

It is also worth paying additional attention to the fact that NetBIOS<\/i> allows you to obtain mac<\/i>-address. Unlike ARP requests, NetBIOS requests can extend beyond the subnet. This can be useful if, for example, you need to find a laptop or specific hardware in the network, knowing its manufacturer. Since the first three octets mac<\/i>-addresses identify the manufacturer, you can send such NetBIOS<\/i>-requests to all known subnets to try to find the desired device (http:\/\/standards-oui.ieee.org\/oui.txt).<\/p>\n

Determining the affiliation to domain<\/a><\/b>
\nOften when moving through internal corporate networks, there is a need to attack the workstation that is part of the domain (for example, to escalate privileges to that of a domain administrator) or vice versa. In this case, NetBIOS<\/i> once again can help:<\/p>\n

\"NetBIOS
\n
\nIn this instance, with the help of NetBIOS<\/i> all names of all types have been obtained. Among them, besides the PC name (which was already obtained earlier), you can also see the workgroup name. By default, for windows<\/i> it is usually something like WORKGROUP<\/i> or IVAN-PC<\/i>, but if the workstation is in a domain, then its workgroup is its domain name.
\nThus, with the help of NetBIOS<\/i> you can find out whether the workstation is in the domain and, if so, in which one.
\nIf you need to obtain a list of domain hosts within a subnet, then a single broadcast request with the name of the desired domain will suffice:<\/p>\n

\"NetBIOS
\n
\nas a result, all hosts in the domain will respond.<\/p>\n

Detecting multihomed hosts<\/b>
\nAnd finally, another possibly very little-known technique, which is simply indispensable for finding paths<\/i> in secured, possibly even physically isolated networks. These could be shop floor networks of enterprises filled with controllers. Access to this network for an attacker means being able to influence the technological process, and for the enterprise, the risk of incurring colossal losses.
\nSo, the essence is that even if a network is isolated from the corporate network, some administrators, either out of laziness or for other reasons, like to activate another network card on their PCs to gain access to that very network. This is, of course, done in violation of various corporate firewall rules. Convenient, yes, but not very safe, especially if you get hacked, then you become a bridge into that network and will bear the responsibility.
\nHowever, there is one problem for the attacker \u2014 finding that particular administrator who has connected to the protected network in such an illegal manner. Moreover, this is a challenging problem for the network security team itself. In large enterprises, this is truly a complex task, akin to finding a needle in a haystack.
\nIn this situation, the obvious options for the attacker would be two:
\n1. try to use every PC in the corporate subnet as a gateway to the required network. This would be very convenient, but it rarely happens since windows<\/i> hosts IP forwarding<\/i> is almost always disabled. Moreover, such a check is only possible within its subnet, and it requires the attacker to know the target address from the isolated network exactly.
\n2. attempt to remotely access each host and execute the simple command ipconfig\/ifconfig<\/i>. And it's not all that straightforward. Even if the attacker has acquired domain administrator rights, firewalls and local firewalls have not been canceled. Therefore, this task cannot be 100% automated. As a result, it becomes painfully necessary to access each host, overcoming network firewalls (often blocking port 445\/tcp), in the hope of finally seeing the desired network interface.<\/p>\n

However, there is a much simpler way. There is one extremely simple technique that allows you to obtain a list of network interfaces from a particular host. Let's say we have some host:<\/p>\n

\"NetBIOS
\n
\nit is a reverse resolve of the IP address to the network name. If we now attempt to do a direct resolve from the network name to the IP address:<\/p>\n

\"NetBIOS
\n
\nwe will find out that this host is also a gateway (presumably) to some other network. It is worth noting that in this case, the request was sent as a broadcast. In other words, it will be heard only by hosts within the attacker's subnet.
\nIf the target host is outside the subnet, a targeted request can be sent:<\/p>\n

\"NetBIOS
\n
\nIn this case, it is clear that the target is outside the attacker's subnet. The -B key was used to specify that the request should be sent to a specific address rather than broadcast.
\nNow, we just need to quickly gather information from the entire interesting subnet, rather than just one address. For this, a small python<\/i>-script can be used:<\/p>\n

\"NetBIOS
\n
\nAnd after a few seconds:<\/p>\n

\"NetBIOS
\n
\nIn this improvised case, the dedicated host would become the first target for the attacker if they were pursuing the 172.16.1\/24 network.<\/p>\n

\"NetBIOS
\n
\nDuplicate names on different IPs indicate that the host also has two network cards, but already in one subnet. It is worth noting that NetBIOS<\/i> does not disclose alias<\/i>-s (which can easily be computed via ARP requests as IPs with the same mac<\/i>). In this case, the IP address<\/a> have different mac<\/i>.<\/p>\n

Another example of using this technique is public Wi-Fi. Sometimes, you may encounter a situation where, among guest devices, personnel working in a closed corporate segment connects to a public network. Then, using this reconnaissance technique, the attacker can quickly outline a path to enter the closed network:<\/p>\n

\"NetBIOS
\n
\nIn this case, among 65 clients of the public Wi-Fi, there were two workstations with an additional interface, likely related to the corporate network.<\/p>\n

If traffic filtering on port 445\/tcp, preventing remote access to the system (remote code execution), is sometimes observed between network segments or directly on workstations, then, in this case, the name resolution on NetBIOS<\/i> uses port 137\/udp, whose intentional blocking is rarely encountered, as it would significantly hinder network convenience, for instance, network environments might disappear, etc.<\/p>\n

As they say, enumeration is the key<\/i>
\nIs there protection against this? There is none, as it is not a vulnerability at all. It is merely the standard functionality of what little is available by default in windows<\/i> (in linux<\/i> (behavior differs slightly). And if you, unexpectedly, circumvented the network routing rules to connect to the closed segment, the attacker will definitely find you and do so very quickly.
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0439\u0434\u0451\u0442 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043f\u043e\u0432\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043d\u0430\u043c \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0430\u044f \u0441 \u0432\u0438\u0434\u0443 \u0432\u0435\u0449\u044c \u043a\u0430\u043a NetBIOS. \u041a\u0430\u043a\u0443\u044e \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\/\u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c, \u0442\u043e \u0435\u0441\u0442\u044c \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0438\u0437\u0432\u043d\u0435 \u0441\u0435\u0442\u044f\u043c. \u0422\u0430\u043a\u0438\u0435 \u0441\u0435\u0442\u0438 \u0435\u0441\u0442\u044c \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0443 \u043b\u044e\u0431\u043e\u0439 \u0434\u0430\u0436\u0435 \u0443 \u0441\u0430\u043c\u043e\u0439 \u043a\u0440\u043e\u0448\u0435\u0447\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0421\u0430\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-30258","post","type-post","status-publish","format-standard","hentry","category-blog"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47NetBIOS in the Hands of a Hacker | ProHoster","description":"This article will provide a brief narrative about what such a seemingly familiar thing as NetBIOS can tell us.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/netbios-v-rukah-hakera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47NetBIOS \u0432 \u0440\u0443\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u043e\u0439\u0434\u0451\u0442 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043f\u043e\u0432\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043d\u0430\u043c \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0442\u0430\u043a\u0430\u044f \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0430\u044f \u0441 \u0432\u0438\u0434\u0443 \u0432\u0435\u0449\u044c \u043a\u0430\u043a NetBIOS.","og:url":"https:\/\/prohoster.info\/en\/blog\/netbios-v-rukah-hakera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:32+00:00","article:modified_time":"2019-10-31T18:34:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30258","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 15:53:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:38:39","updated":"2026-02-09 15:53:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=30258"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30258\/revisions"}],"predecessor-version":[{"id":158465,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/30258\/revisions\/158465"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=30258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=30258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=30258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}