Port 139 – NetBIOS Session Service (SMB over NetBIOS)

Port 139 is the default TCP port for the NetBIOS Session Service (netbios-ssn), the legacy transport that carried SMB/CIFS file-and-printer sharing before Windows added direct-hosted SMB on port 445. It’s the connection-oriented, session half of NetBIOS over TCP/IP (NBT), sitting alongside the name service on 137 and the datagram service on 138: where 137 resolves names and 138 sprays broadcasts, port 139 sets up the reliable session a client uses to authenticate and then read or write shares. SMB moved to 445 years ago, but Windows still ships NBT enabled by default, so 139 keeps answering — which is exactly why it remains one of the most productive targets on an internal engagement.

Why It’s Open

NetBIOS over TCP/IP is on by default on Windows, so port 139 comes up alongside 137, 138, and 445 on nearly every Windows host, domain controller, NAS box, and anything running Samba’s smbd. It exists because SMB originally had no transport of its own: the protocol ran inside a NetBIOS session, and 139 is where that session is established. Modern Windows prefers direct-hosted SMB on 445 and only falls back to 139 when 445 is blocked or unavailable — but the port stays open because nobody disabled NBT, and older domains, print servers, and embedded devices still depend on it. Seeing 139 and 445 open together is the classic Windows fingerprint.

Port 139 vs Port 445

This is the distinction that trips people up, and it’s worth getting right before you test either port. Both carry SMB, but they are different transports:

• Port 139 (SMB over NetBIOS). The client first sets up a NetBIOS session on 139, then runs SMB inside it. This is the older path, used by legacy Windows, Samba, and hosts where NBT is still enabled. Null-session enumeration and SMBv1 exposure are the classic 139 findings.
• Port 445 (direct-hosted SMB). SMB runs straight over TCP with no NetBIOS layer. It’s the default on modern Windows and the only transport for newer dialects — SMBv3 features like encryption and compression are 445-only and never ride the NetBIOS session on 139.

In practice you enumerate whichever is open and fall back to the other. If both answer, prefer 445 for modern dialects; 139 matters most on older or misconfigured hosts and is where anonymous IPC$ “null sessions” still tend to work. For everything specific to direct-hosted SMB, see the dedicated port 445 page.

Common Risks

• Null-session enumeration. This is the signature port 139 finding. Older or misconfigured hosts accept an anonymous, unauthenticated connection to the IPC$ share — a “null session” — which leaks the user list, groups, shares, and the domain password policy with no credentials at all. It’s often the first real foothold on an internal test.
• SMBv1 legacy exploits. If SMBv1 is still enabled, the session on 139 is reachable by EternalBlue (MS17-010) and MS08-067 — pre-auth remote code execution that should not exist on a modern network.
• NTLM relay. An NTLM authentication captured on the segment can be relayed to another host that still accepts NTLM and isn’t enforcing SMB signing, turning a single hash into remote access with no cracking required.
• Share misconfiguration. World-readable or world-writable shares remain common in the wild, especially on file servers and NAS appliances, and a writable share the web server also serves can become code execution.
• Lateral movement. Once an attacker has any valid credential, 139/445 is the primary channel for spreading through a Windows environment.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Fingerprint and vuln-scan SMB with Nmap

nmap -p 139,445 -sV --script="smb-os-discovery,smb-enum-shares,smb-enum-users,smb-protocols,smb-security-mode,smb-vuln-*" <target>

Pull the NetBIOS name table

nbtscan -r <target>/24
nmblookup -A <target>

Null-session enumeration

enum4linux -a <target>
enum4linux-ng -A <target>

rpcclient -U "" -N <target>
# inside rpcclient:
#   srvinfo
#   enumdomusers
#   querydominfo

The whole point of a null session is that it needs no password: -U "" -N connects anonymously to IPC$ and, on a vulnerable host, hands back users, groups, and the password policy.

List and browse shares with smbclient

smbclient -L //<target>/ -N
smbclient -L //<target>/ -U '<user>%<pass>'
smbclient //<target>/<share> -N

Sweep with CrackMapExec / NetExec

crackmapexec smb <target>/24 -u '' -p ''
netexec smb <target>/24 -u <user> -p <pass> --shares --users --groups

Metasploit modules

use auxiliary/scanner/smb/smb_version
use auxiliary/scanner/smb/smb_enumshares
use auxiliary/scanner/smb/smb_enumusers
use auxiliary/scanner/smb/smb_login
use auxiliary/scanner/smb/smb_ms17_010
use exploit/windows/smb/ms17_010_eternalblue
use exploit/windows/smb/ms08_067_netapi

Capture and relay NTLM (Responder + ntlmrelayx)

sudo responder -I eth0 -wv
impacket-ntlmrelayx -tf targets.txt -smb2support

Every share, user list, and password policy you pull off port 139 is reconnaissance — keep it with the run and drop it into the pentest report as both a finding and a map of the domain rather than losing it in scrollback.

What to Look For

Known CVEs and Exploits

Because port 139 carries an SMB session, the genuinely famous SMB vulnerabilities are reachable here whenever SMBv1 is enabled — but be precise about the transport. EternalBlue and MS08-067 target SMBv1 / the Server service, both of which ride the NetBIOS session on 139 as well as direct-hosted SMB on 445. (SMBv3-only bugs such as SMBGhost / CVE-2020-0796 are not in scope here — SMBv3 never uses the NetBIOS session transport, so that one belongs to port 445.)

• CVE-2017-0144 — MS17-010, “EternalBlue.” The SMBv1 server allows a remote, unauthenticated attacker to run arbitrary code via crafted packets. It is reachable over both port 139 and port 445 wherever SMBv1 is enabled, because the SMB session runs over the NetBIOS session service. CVSS 8.8; scan with auxiliary/scanner/smb/smb_ms17_010 (which checks via an anonymous IPC$ connection) and exploit with exploit/windows/smb/ms17_010_eternalblue / Exploit-DB 41891. The most consequential Windows vulnerability of the decade.
• CVE-2008-4250 — MS08-067. A crafted RPC request to the Windows Server service (reached over the SMB named pipe on 139/445) triggers a stack overflow during path canonicalization, giving pre-auth code execution as SYSTEM. CVSS 9.8 — the bug behind Conficker. Ready-made via exploit/windows/smb/ms08_067_netapi.
• CVE-1999-0519 — The canonical null-session finding: “A NETBIOS/SMB share password is the default, null, or missing.” An anonymous connection to IPC$ (or a share left with a null/default password) turns port 139 into unauthenticated reconnaissance and often file access. Decades old and still flagged on legacy Windows and misconfigured Samba.

Mitigation

• Disable SMBv1 entirely. Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol, or on older builds Set-SmbServerConfiguration -EnableSMB1Protocol $false. This removes the EternalBlue / MS08-067 attack surface.
• Disable NetBIOS over TCP/IP. Turn it off per-adapter (Advanced TCP/IP Settings → WINS), push it with DHCP option 001 (microsoft-disable-netbios), or set it by GPO. That closes 137, 138, and 139 together and forces SMB onto 445, where it belongs on a modern network.
• Restrict anonymous access. Set RestrictAnonymous / RestrictAnonymousSAM and disable the guest account so null sessions return nothing.
• Enforce SMB signing via Group Policy to blunt NTLM relay.
• Firewall ports 137–139 at the perimeter and between segments — the NetBIOS range should never be reachable from the internet or cross a trust boundary.
• Patch MS17-010 and MS08-067 on any legacy host still in production.

Real-World Example

In May 2017, WannaCry weaponized EternalBlue — the SMBv1 remote code execution flaw (MS17-010) reachable over the NetBIOS session on port 139 as well as direct-hosted SMB on 445 — to propagate through hundreds of thousands of unpatched Windows systems in a single weekend, including NHS hospitals, FedEx, Telefónica, and Renault factories. The patch had been available for two months. On internal engagements the same port tells a quieter story first: a tester runs enum4linux against 139, the host accepts an anonymous IPC$ null session, and out come the domain users, groups, and password policy — no credentials, no exploit — which is precisely the reconnaissance that turns a single open port into a foothold.

FAQ

What is port 139 used for?

Port 139 runs the NetBIOS Session Service (netbios-ssn), the connection-oriented part of NetBIOS over TCP/IP. Historically it carried SMB/CIFS file and printer sharing on Windows LANs: a client opens a NetBIOS session on 139 and then runs SMB inside it. Modern Windows has largely moved that traffic to port 445, but 139 stays open because NetBIOS is enabled by default.

What is the difference between port 139 and port 445?

Both carry SMB, but the transport differs. Port 139 runs SMB inside a NetBIOS session (SMB over NetBIOS), the legacy path used by older Windows and Samba. Port 445 is direct-hosted SMB — the protocol straight over TCP with no NetBIOS layer — and is the default on modern systems and the only transport for newer SMB dialects. If both are open, 445 handles current traffic while 139 is the legacy fallback where anonymous null sessions most often still work.

Is port 139 dangerous?

On an internal network, yes. It’s the classic null-session surface: an anonymous connection to IPC$ can leak users, groups, shares, and the password policy, and if SMBv1 is enabled it exposes the host to EternalBlue and MS08-067 remote code execution. It should never be reachable from the internet, so the real risk is on the LAN — but there it’s a reliable attacker foothold.

What is netbios-ssn and how do I close port 139?

netbios-ssn is simply the service name Nmap and IANA use for the NetBIOS Session Service on port 139. To close it, disable NetBIOS over TCP/IP on each adapter (Advanced TCP/IP Settings → WINS tab) or push it network-wide with a GPO or DHCP option 001 — that shuts 137, 138, and 139 together — then firewall the NetBIOS range and disable SMBv1. Active Directory doesn’t need NetBIOS, so turning it off is safe in most environments.

TL;DR

• Service: NetBIOS Session Service (netbios-ssn) — SMB/CIFS over the legacy NetBIOS transport
• Default port: 139/TCP (the session half of NetBIOS over TCP/IP, with 137 and 138 completing the stack; SMB otherwise runs on 445)
• Biggest risk: anonymous IPC$ null-session enumeration, plus SMBv1 RCE (EternalBlue / MS08-067) and NTLM relay
• Mitigation: disable SMBv1 and NetBIOS over TCP/IP, restrict anonymous access, enforce SMB signing, firewall 137–139, and patch MS17-010 / MS08-067