File transfer & sharingTCP/UDP 137, 138, 139 Cleartext by default
Port 137, 138, 139: NetBIOS
NetBIOS
Legacy Windows name service (137), datagram (138) and session (139) services, the old transport for SMB.
How attackers abuse it
- Name-service poisoning (NBT-NS) to capture credential hashes.
- Information leakage about hosts and users.
How to defend it
- Disable NetBIOS over TCP/IP and LLMNR where not needed.
- Block at the perimeter.
Exam tip
Responder-style attacks poison LLMNR and NBT-NS - disabling both is the standard fix.