logo

Port 139 – NetBIOS Session Service

Service:

netbios-ssn

Protocol:

TCP

Port:

139

Used for:

File and printer sharing in Windows networks

Why It’s Open

Used by SMB over NetBIOS for Windows file and printer sharing before SMB over TCP/445 became common.

Common Risks

  • SMB Exploits: Legacy SMB 1.0 vulnerabilities (e.g., EternalBlue) often used this port.
  • Credential Theft: Man-in-the-middle attacks can capture NTLM hashes.
  • Unauthorized Access: If shared folders aren’t locked down.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Nmap Check

Terminal window
nmap -p 139 --script smb-os-discovery


nbtscan

What to Look For

CheckpointWhat it means
Open sharesRisk of data exposure
SMBv1 in useVulnerable to known exploits
Null sessionsAllows unauthenticated access

Known Exploits

  1. CVE-1999-0504 NetBIOS NULL session allows unauthorized access to shares. 🔗 NVD Entry

Mitigation

  • Disable SMBv1 and NetBIOS if possible.
  • Move to SMB over port 445 with secure settings.
  • Use proper authentication and share permissions.

Real-Life Example

Port 139 has been a favorite target for ransomware, worms, and lateral movement in Windows environments for over two decades.

TL;DR

  • Service: NetBIOS Session Service
  • Risks: Unauthorized access, information disclosure
  • Mitigation: Disable NetBIOS over TCP/IP if not needed, restrict access