Skip to content
HackIndex logo

HackIndex

NetBIOS Information Disclosure

3 min read May 15, 2026

NetBIOS leaks infrastructure information without authentication — hostnames, domain or workgroup names, MAC addresses, logged-in usernames, and browse master roles. On local segments, the NBT-NS (NetBIOS Name Service) and LLMNR broadcast protocols create a poisoning surface that enables NTLM hash capture without any prior access. These are two distinct findings: passive information disclosure via queries, and active poisoning opportunity via unanswered broadcast name resolution.

Information Leaked Without Authentication

Pull what NetBIOS exposes before touching any authenticated service:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP 
Looking up status of 10.10.10.50
	WS01            <00> -         B <ACTIVE>
	COMPANY         <00> - <GROUP> B <ACTIVE>
	WS01            <20> -         B <ACTIVE>
	JSMITH          <03> -         B <ACTIVE>
	COMPANY         <1c> - <GROUP> B <ACTIVE>
	WS01            <1b> -         B <ACTIVE>
	MAC Address = 00-11-22-33-44-55

This single unauthenticated query reveals: hostname (WS01), domain (COMPANY), logged-in username (JSMITH<03>), that File Sharing is active (<20>), that this host is the Domain Master Browser (<1b>), and the hardware MAC address. None of this requires credentials.

Logged-In Username Disclosure

The <03> suffix registers the currently logged-in username under the Messenger service. When present, it reveals an active account — high-value for password spraying:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP | grep '<03>' 
	JSMITH          <03> -         B <ACTIVE>
┌──(kali㉿kali)-[~]
└─$ nbtscan 10.10.10.0/24 | awk '{print $1, $4}' | grep -v '<unknown>' 
10.10.10.50 JSMITH
10.10.10.51 ADMINISTRATOR
10.10.10.55 SVCACCOUNT

ADMINISTRATOR logged in at 10.10.10.51 is an immediate priority target. SVCACCOUNT suggests a service account — often has weaker passwords and may have elevated privileges.

Browse Master Identification

The Domain Master Browser (<1b>) maintains the network browse list and is often the most active Windows machine on the segment — frequently a DC or file server:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP | grep '<1b>' 
	WS01            <1b> -         B <ACTIVE>
┌──(kali㉿kali)-[~]
└─$ # Find the domain master browser for a domain
┌──(kali㉿kali)-[~]
└─$ nmblookup -d 2 -S COMPANY#1b 2>/dev/null | grep -iE 'IP|name'

LLMNR and NBT-NS Poisoning Surface

When a Windows host cannot resolve a name via DNS, it falls back to multicast LLMNR (Link-Local Multicast Name Resolution) and broadcast NBT-NS queries. Any host on the segment can respond to these — this is the Responder attack surface. Confirm the protocols are active on the local segment by listening for broadcast traffic:

┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -A 
[*] [LLMNR] Poisoned answer sent to 10.10.10.51 for name fileserver
[*] [NBT-NS] Poisoned answer sent to 10.10.10.55 for name BACKUP

Analyze mode (-A) shows which names are being queried without actually responding — confirming the poisoning surface exists without triggering hash capture. Hosts querying for fileserver and BACKUP are failing DNS resolution and falling back to broadcast, which means they will accept a poisoned response. These names are also candidates for SMB share paths worth probing directly.

MAC Address and Vendor Identification

The MAC address in NetBIOS responses identifies the network interface vendor — useful for identifying virtual machines, specific hardware, and network segmentation:

┌──(kali㉿kali)-[~]
└─$ nbtscan 10.10.10.0/24 | awk '{print $1, $5}' | grep -v '00:00:00' 
10.10.10.10  00:50:56:01:23:45
10.10.10.50  00:11:22:33:44:55
10.10.10.51  00:0c:29:ab:cd:ef
┌──(kali㉿kali)-[~]
└─$ curl -sk "https://api.macvendors.com/00:50:56" | head -1 
VMware, Inc.

00:50:56 is a VMware OUI — hosts with this prefix are VMware virtual machines, common in CTF and lab environments. 00:0c:29 is also VMware. Knowing the environment is virtualized informs attack assumptions about shared storage and snapshot recovery.

The <20> suffix confirming file sharing is active is a direct pivot to SMB Null Session Enumeration. Usernames disclosed by NetBIOS feed directly into AD Password Spraying.

References