File transfer & sharingTCP 445 Encrypted
Port 445: SMB
Server Message Block
Windows file and printer sharing, also used for remote administration. Runs directly over TCP 445.
How attackers abuse it
- Wormable vulnerabilities - EternalBlue (MS17-010) powered WannaCry and NotPetya.
- Lateral movement with stolen credentials (pass-the-hash, PsExec-style tools).
- NTLM relay where SMB signing is off.
How to defend it
- Never expose 445 to the internet; block it between workstations.
- Disable SMBv1; require SMB signing; patch promptly.
- Use SMB encryption for sensitive shares.
Exam tip
SMBv1 should be disabled everywhere. WannaCry is the textbook example of why 445 must not face the internet.