312-50 Question 87
Single answer▪ NetBIOS EnumerationDuring an internal penetration test, you identify a Windows host at 10.10.20.15 with TCP 139 open, but TCP 445 is filtered. The client wants you to determine the system's NetBIOS computer name and workgroup/domain information without attempting credentialed access or exploiting the host. Which action is the most appropriate next step for NetBIOS enumeration?
- A
Use nbtstat -A 10.10.20.15 to query the remote NetBIOS name table
- B
Run smbclient -L //10.10.20.15 -N to retrieve the NetBIOS names over SMB
- C
Perform an SNMP walk against 10.10.20.15 to enumerate the Windows workgroup
- D
Use ldapsearch against 10.10.20.15 to query the host's domain membership directly
- E
Send an HTTP OPTIONS request to 10.10.20.15 to discover the NetBIOS suffix values
Show answer and explanation
Correct answer: A
Explanation
In this scenario, the objective is limited, specific, and aligned with NetBIOS enumeration: identify the remote system's NetBIOS computer name and workgroup/domain information without using credentials or exploiting the host. The best next step is to query the remote NetBIOS name table directly using nbtstat -A against the IP address. This leverages NetBIOS Name Service on UDP 137 and commonly returns registered names and suffix codes that indicate roles and group membership. For example, suffix <00> often indicates the workstation service name, <20> the file server service, and group entries can help identify the workgroup or domain context. This approach is consistent with common Windows NetBIOS troubleshooting and enumeration practices documented by Microsoft for NBTSTAT and NetBIOS over TCP/IP behavior. By contrast, SMB share listing, LDAP queries, SNMP polling, and HTTP methods are either less appropriate, require different services, or do not directly enumerate the NetBIOS name table.
- A. Correct.
Correct. NetBIOS Name Service (NBNS) operates over UDP 137, and the nbtstat -A
command is specifically designed to query a remote host's NetBIOS name table by IP address. This can reveal the computer name, logged-on user in some cases, and workgroup/domain-related NetBIOS suffix entries such as <00>, <20>, and <1E>, making it a standard and non-intrusive NetBIOS enumeration step. - B. Incorrect.
Incorrect. smbclient -L can enumerate SMB shares, but it relies on SMB connectivity, typically over TCP 445 or NetBIOS Session Service on TCP 139, and may require a successful session setup even when using a null session. The scenario specifically asks for the most appropriate next step to determine NetBIOS name and workgroup/domain information without attempting credentialed access or broader SMB enumeration. Querying the NetBIOS name table directly with nbtstat is more targeted and appropriate for NetBIOS enumeration.
- C. Incorrect.
Incorrect. SNMP can expose useful system information if the service is enabled and community strings are known or guessable, but it is not the standard mechanism for NetBIOS enumeration. Choosing SNMP here reflects the misconception that any management protocol can substitute for NBNS when the goal is specifically to enumerate NetBIOS names and suffixes.
- D. Incorrect.
Incorrect. LDAP is used for directory queries, typically against domain controllers, not for directly querying an arbitrary Windows host for its NetBIOS name table. This option confuses Active Directory enumeration with NetBIOS enumeration. Also, LDAP would require the target to expose the service and usually involves a different type of host and query workflow.
- E. Incorrect.
Incorrect. HTTP OPTIONS is an application-layer web method used to discover supported HTTP verbs on a web server. It has no relationship to NetBIOS name service or NetBIOS suffix enumeration. This distractor targets the misconception that any network service can reveal host identity details in the same way as NBNS.