312-50 Question 85
Single answer▪ NetBIOS EnumerationDuring an authorized internal assessment, you discover that a legacy Windows file server is listening on UDP/137 and TCP/139, but SMB over TCP/445 is filtered by an internal firewall. You want to identify the remote system's NetBIOS computer name, logged-in user, and workgroup/domain information using a technique specifically aligned with NetBIOS enumeration. Which action is the most appropriate next step?
- A
Use an NBSTAT query against the target to retrieve its NetBIOS name table and session-related information
- B
Run an SNMP walk against UDP/161 to enumerate Windows shares and NetBIOS names without credentials
- C
Perform a DNS zone transfer against the internal DNS server to obtain the target's logged-in user and NetBIOS session list
- D
Use an LDAP anonymous bind to the server on TCP/389 to directly retrieve the target host's NetBIOS name table
Show answer and explanation
Correct answer: A
Explanation
The key clue is that UDP/137 and TCP/139 are available while TCP/445 is blocked. NetBIOS enumeration relies on the NetBIOS Name Service and related legacy SMB/NetBIOS mechanisms rather than direct SMB over 445. A NetBIOS Name Service status query, commonly referred to via tools such as nbstat/nbtstat-style functionality, can return the target's NetBIOS name table, including unique and group names that often identify the hostname, workgroup or domain, and sometimes user-associated entries. In CEH-style scenarios, this is the classic approach for NetBIOS enumeration when ports 137/139 are exposed. This aligns with Microsoft's NetBIOS over TCP/IP behavior and standard NetBIOS Name Service concepts described in RFC 1001 and RFC 1002. Best practice today is to disable NetBIOS over TCP/IP where not required and rely on modern SMB protections, but legacy environments still frequently expose these services, making this a realistic assessment scenario.
- A. Correct.
Correct. NetBIOS enumeration commonly uses NBSTAT/NetBIOS Name Service queries over UDP/137 to retrieve the remote NetBIOS name table. This can reveal the computer name, workgroup or domain, and in some cases the username associated with a logged-in session via registered NetBIOS names such as the <03> messenger-related entry. In a scenario where TCP/445 is blocked but UDP/137 and TCP/139 are reachable, NBSTAT is the most appropriate protocol-specific technique.
- B. Incorrect.
Incorrect. SNMP can expose useful host information if enabled and misconfigured, but it is not the standard method for NetBIOS name-table enumeration. An SNMP walk on UDP/161 does not inherently enumerate NetBIOS session data or Windows shares without the correct MIB support and access, and it is not the best next step when the question asks for a NetBIOS-specific enumeration technique.
- C. Incorrect.
Incorrect. A DNS zone transfer, if allowed, may reveal hostnames and IP mappings for a DNS zone, but it does not provide NetBIOS name-table details, logged-in user information, or active NetBIOS session-related data from a specific target. This option reflects a common misconception that DNS and NetBIOS naming data are interchangeable.
- D. Incorrect.
Incorrect. LDAP is used for directory services such as querying Active Directory objects, typically on domain controllers, and not for directly retrieving a host's NetBIOS name table. An anonymous LDAP bind may be disabled and, even if allowed, would not serve as the primary method for extracting NetBIOS registration entries from an individual Windows server.