# NetBIOS Information Disclosure - **URL:** https://hackindex.io/services/netbios/vulnerability-discovery/netbios-information-disclosure - **Path:** NetBIOS > Vulnerability Discovery - **Up:** [Vulnerability Discovery](https://hackindex.io/services/netbios/vulnerability-discovery.md) - **Published:** 2026-03-30 - **Updated:** 2026-05-15 ## NetBIOS Information Disclosure NetBIOS leaks infrastructure information without authentication: hostnames, domain or workgroup names, MAC addresses, logged-in usernames, and browse master roles. On local segments, the NBT-NS (NetBIOS Name Service) and LLMNR broadcast protocols create a poisoning surface that enables NTLM hash capture without any prior access. These are two distinct findings: passive information disclosure via queries, and active poisoning opportunity via unanswered broadcast name resolution. - Information Leaked Without Authentication - Logged-In Username Disclosure - Browse Master Identification - LLMNR and NBT-NS Poisoning Surface - MAC Address and Vendor Identification ## Information Leaked Without Authentication Pull what NetBIOS exposes before touching any authenticated service: ```bash nmblookup -A $TARGET_IP # Looking up status of 10.10.10.50 # WS01 <00> - B # COMPANY <00> - B # WS01 <20> - B # JSMITH <03> - B # COMPANY <1c> - B # WS01 <1b> - B # MAC Address = 00-11-22-33-44-55 ``` This single unauthenticated query reveals: hostname (`WS01`), domain (`COMPANY`), logged-in username (`JSMITH<03>`), that File Sharing is active (`<20>`), that this host is the Domain Master Browser (`<1b>`), and the hardware MAC address. None of this requires credentials. ## Logged-In Username Disclosure The `<03>` suffix registers the currently logged-in username under the Messenger service. When present, it reveals an active account: high-value for password spraying: ```bash nmblookup -A $TARGET_IP | grep '<03>' # JSMITH <03> - B ``` ```bash nbtscan $TARGET_SUBNET/24 | awk '{print $1, $4}' | grep -v '' # 10.10.10.50 JSMITH # 10.10.10.51 ADMINISTRATOR # 10.10.10.55 SVCACCOUNT ``` ADMINISTRATOR logged in at 10.10.10.51 is an immediate priority target. SVCACCOUNT suggests a service account: often has weaker passwords and may have elevated privileges. ## Browse Master Identification The Domain Master Browser (`<1b>`) maintains the network browse list and is often the most active Windows machine on the segment: frequently a DC or file server: ```bash nmblookup -A $TARGET_IP | grep '<1b>' # WS01 <1b> - B ``` ```bash # Find the domain master browser for a domain nmblookup -d 2 -S COMPANY#1b 2>/dev/null | grep -iE 'IP|name' ``` ## LLMNR and NBT-NS Poisoning Surface When a Windows host cannot resolve a name via DNS, it falls back to multicast LLMNR (Link-Local Multicast Name Resolution) and broadcast NBT-NS queries. Any host on the segment can respond to these: this is the Responder attack surface. Confirm the protocols are active on the local segment by listening for broadcast traffic: > [!CAUTION] > Responder poisons broadcasts and affects all hosts on the segment. Only run on networks with explicit authorization. Passive listening with -A (analyze mode) is safe and leaves no poisoning trace. ```bash responder -I eth0 -A # [Analyze mode: LLMNR] Seen query from 10.10.10.51 for fileserver # [Analyze mode: NBT-NS] Seen query from 10.10.10.55 for BACKUP ``` Analyze mode (`-A`) shows which names are being queried without actually responding: confirming the poisoning surface exists without triggering hash capture. Hosts querying for `fileserver` and `BACKUP` are failing DNS resolution and falling back to broadcast, which means they will accept a poisoned response. These names are also candidates for SMB share paths worth probing directly. ## MAC Address and Vendor Identification The MAC address in NetBIOS responses identifies the network interface vendor: useful for identifying virtual machines, specific hardware, and network segmentation: ```bash nbtscan $TARGET_SUBNET/24 | awk '{print $1, $5}' | grep -v '00:00:00' # 10.10.10.10 00:50:56:01:23:45 # 10.10.10.50 00:11:22:33:44:55 # 10.10.10.51 00:0c:29:ab:cd:ef ``` ```bash curl -sk "https://api.macvendors.com/00:50:56" | head -1 # VMware, Inc. ``` 00:50:56 is a VMware OUI: hosts with this prefix are VMware virtual machines, common in CTF and lab environments. 00:0c:29 is also VMware. Knowing the environment is virtualized informs attack assumptions about shared storage and snapshot recovery. The `<20>` suffix confirming file sharing is active is a direct pivot to [SMB Null Session Enumeration](https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration). Usernames disclosed by NetBIOS feed directly into [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying). ## References - [Responder](https://github.com/lgandx/Responder) - LLMNR and NBT-NS poisoner with analyze mode for passive surface assessment - [nbtscan](https://www.kali.org/tools/nbtscan/) - Subnet NetBIOS scanning with MAC and logged-in user output