Skip to content
HackIndex.io

NetBIOS Information Disclosure

3 min read Created Mar 30, 2026 Last updated May 15, 2026

NetBIOS Information Disclosure

NetBIOS leaks infrastructure information without authentication: hostnames, domain or workgroup names, MAC addresses, logged-in usernames, and browse master roles. On local segments, the NBT-NS (NetBIOS Name Service) and LLMNR broadcast protocols create a poisoning surface that enables NTLM hash capture without any prior access. These are two distinct findings: passive information disclosure via queries, and active poisoning opportunity via unanswered broadcast name resolution.

  • Information Leaked Without Authentication
  • Logged-In Username Disclosure
  • Browse Master Identification
  • LLMNR and NBT-NS Poisoning Surface
  • MAC Address and Vendor Identification

Information Leaked Without Authentication

Pull what NetBIOS exposes before touching any authenticated service:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP 
Looking up status of 10.10.10.50
	WS01            <00> -         B <ACTIVE>
	COMPANY         <00> - <GROUP> B <ACTIVE>
	WS01            <20> -         B <ACTIVE>
	JSMITH          <03> -         B <ACTIVE>
	COMPANY         <1c> - <GROUP> B <ACTIVE>
	WS01            <1b> -         B <ACTIVE>
	MAC Address = 00-11-22-33-44-55

This single unauthenticated query reveals: hostname (WS01), domain (COMPANY), logged-in username (JSMITH<03>), that File Sharing is active (<20>), that this host is the Domain Master Browser (<1b>), and the hardware MAC address. None of this requires credentials.

Logged-In Username Disclosure

The <03> suffix registers the currently logged-in username under the Messenger service. When present, it reveals an active account: high-value for password spraying:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP | grep '<03>' 
	JSMITH          <03> -         B <ACTIVE>
┌──(kali㉿kali)-[~]
└─$ nbtscan $TARGET_SUBNET/24 | awk '{print $1, $4}' | grep -v '<unknown>' 
10.10.10.50 JSMITH
10.10.10.51 ADMINISTRATOR
10.10.10.55 SVCACCOUNT

ADMINISTRATOR logged in at 10.10.10.51 is an immediate priority target. SVCACCOUNT suggests a service account: often has weaker passwords and may have elevated privileges.

Browse Master Identification

The Domain Master Browser (<1b>) maintains the network browse list and is often the most active Windows machine on the segment: frequently a DC or file server:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP | grep '<1b>' 
	WS01            <1b> -         B <ACTIVE>
┌──(kali㉿kali)-[~]
└─$ # Find the domain master browser for a domain
┌──(kali㉿kali)-[~]
└─$ nmblookup -d 2 -S COMPANY#1b 2>/dev/null | grep -iE 'IP|name'

LLMNR and NBT-NS Poisoning Surface

When a Windows host cannot resolve a name via DNS, it falls back to multicast LLMNR (Link-Local Multicast Name Resolution) and broadcast NBT-NS queries. Any host on the segment can respond to these: this is the Responder attack surface. Confirm the protocols are active on the local segment by listening for broadcast traffic:

┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -A 
[Analyze mode: LLMNR] Seen query from 10.10.10.51 for fileserver
[Analyze mode: NBT-NS] Seen query from 10.10.10.55 for BACKUP

Analyze mode (-A) shows which names are being queried without actually responding: confirming the poisoning surface exists without triggering hash capture. Hosts querying for fileserver and BACKUP are failing DNS resolution and falling back to broadcast, which means they will accept a poisoned response. These names are also candidates for SMB share paths worth probing directly.

MAC Address and Vendor Identification

The MAC address in NetBIOS responses identifies the network interface vendor: useful for identifying virtual machines, specific hardware, and network segmentation:

┌──(kali㉿kali)-[~]
└─$ nbtscan $TARGET_SUBNET/24 | awk '{print $1, $5}' | grep -v '00:00:00' 
10.10.10.10  00:50:56:01:23:45
10.10.10.50  00:11:22:33:44:55
10.10.10.51  00:0c:29:ab:cd:ef
┌──(kali㉿kali)-[~]
└─$ curl -sk "https://api.macvendors.com/00:50:56" | head -1 
VMware, Inc.

00:50:56 is a VMware OUI: hosts with this prefix are VMware virtual machines, common in CTF and lab environments. 00:0c:29 is also VMware. Knowing the environment is virtualized informs attack assumptions about shared storage and snapshot recovery.

The <20> suffix confirming file sharing is active is a direct pivot to SMB Null Session Enumeration. Usernames disclosed by NetBIOS feed directly into AD Password Spraying.

References