150.165.135.201

Repartition of the level of the security problems :

List of open ports :

• unknown (135/tcp)
• netbios-ssn (139/tcp) (Security hole found)
• general/tcp (Security notes found)
• netbios-ns (137/udp) (Security warnings found)
• general/udp (Security notes found)
• general/icmp (Security warnings found)

Vulnerability found on port netbios-ssn (139/tcp)

. It was possible to log into the remote host using a NULL session.
The concept of a NULL session is to provide a null username and
a null password, which grants the user the 'guest' access


. All the smb tests will be done as ''/''

Warning found on port netbios-ssn (139/tcp)

Here is the browse list of the remote host :

IZA -
LAB1-02 -
LAB1-03 -
LAB1-07 -


This is potentially dangerous as this may help the attack
of a potential hacker by giving him extra targets to check for

Solution : filter incoming traffic to this port
Risk factor : Low

Warning found on port netbios-ssn (139/tcp)

The host SID can be obtained remotely. Its value is :

LAB1-03 : 5-21-960330522-3693065397-3259318345

An attacker can use it to obtain the list of the local users of this host
Solution : filter the ports 137 to 139
Risk factor : Low

Warning found on port netbios-ssn (139/tcp)

The SID could be used to enumerate the names of the users
of this host.
(we only enumerated users name whose ID is between 1000 and 1200
for performance reasons)
This gives extra knowledge to a cracker, which
is not a good thing :
- Administrator account name : Administrador (id 500)
- Guest account name : Convidado (id 501)

Risk factor : Medium
Solution : filter incoming connections to port 139

Information found on port general/tcp

Nmap found that this host is running Windows NT4 / Win95 / Win98

Warning found on port netbios-ns (137/udp)

. The following 6 NetBIOS names have been gathered :
LAB1-03
LABMAT
LAB1-03
LAB1-03
MRND
LABMAT
. The remote host has the following MAC address on its adapter :
0x48 0x54 0x33 0x00 0x80 0xe1

If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.

Risk factor : Medium

Information found on port general/udp

For your information, here is the traceroute to 150.165.135.201 :
150.165.250.100
150.165.254.254
150.165.254.35
150.165.253.133
150.165.135.201

Warning found on port general/icmp

The remote host answered to an ICMP_MASKREQ
query and sent us its netmask.

An attacker can use this information to
understand how your network is set up
and how the routing is done. This may
help him to bypass your filters.

Solution : reconfigure the remote host so
that it does not answer to those requests.
Set up filters that deny ICMP packets of
type 17.

Risk factor : Low
CVE : CAN-1999-0524