312-50 Question 86
Single answer▪ NetBIOS EnumerationDuring an internal assessment, you identify a legacy Windows file server that responds on UDP/137 and TCP/139, but SMB signing and guest access are disabled. You want to enumerate NetBIOS information with the least intrusive technique to discover the remote host's NetBIOS name table, including the workstation, server service, and logged-in user information if exposed. Which action is the most appropriate?
- A
Query the target's NetBIOS Name Service on UDP/137 using a tool such as nbtstat or nbtscan to retrieve the NetBIOS name table
- B
Perform an SMB null session on TCP/445 to dump SAM account hashes directly from the server
- C
Send SNMP community string guesses to UDP/161 to enumerate Windows shares and NetBIOS suffix mappings
- D
Use an LDAP anonymous bind to TCP/389 to extract the target host's NetBIOS suffix list and local session names
Show answer and explanation
Correct answer: A
Explanation
The best answer is to query NBNS on UDP/137 for the remote NetBIOS name table. In NetBIOS enumeration, testers often use tools such as nbtstat -A
- A. Correct.
Correct. NetBIOS enumeration commonly begins with querying the NetBIOS Name Service (NBNS) over UDP/137. Tools such as nbtstat and nbtscan can request the remote NetBIOS name table, which may reveal the computer name, workgroup/domain, service types through suffix values such as <00>, <20>, and in some cases user-related entries like <03>. This is a low-impact and realistic first step when UDP/137 is exposed.
- B. Incorrect.
Incorrect. SMB null sessions may allow certain forms of enumeration on misconfigured systems, but they do not 'dump SAM account hashes directly' simply because TCP/445 is open. Extracting hashes requires different attack paths and privileges. Also, the scenario asks specifically for the least intrusive method to obtain the NetBIOS name table, which is better achieved through NBNS on UDP/137 rather than an SMB session attempt.
- C. Incorrect.
Incorrect. SNMP uses UDP/161 and can provide useful device information if community strings are known, but it is not the standard method for retrieving a Windows host's NetBIOS name table or NetBIOS suffix records. This option mixes two separate enumeration techniques and reflects a common misconception that any management protocol can expose NetBIOS naming data.
- D. Incorrect.
Incorrect. LDAP on TCP/389 is used to query directory information, typically in Active Directory environments, and anonymous bind access is often restricted. LDAP does not provide the target host's NetBIOS name table in the same way NBNS does. This option confuses directory enumeration with host-level NetBIOS enumeration.