Skip to main content
protocols.pageprotocols.page
139

Port 139 – NetBIOS Session

TCP

Port 139 is the NetBIOS Session Service port used by SMBv1 for Windows file and printer sharing over NetBIOS. Exposing port 139 to the internet is extremely dangerous – it was the entry point for WannaCry, NotPetya, and EternalBlue exploits. Modern systems use SMB over port 445 directly without NetBIOS.

Port Number

139

Protocol

TCP

Service

NetBIOS Session Service

Range

IANA Well-Known (0–1023)

Description

NetBIOS Session Service on port 139 provides the session layer for legacy SMBv1 file sharing on Windows networks. It requires NetBIOS name resolution (port 137 UDP) and datagram services (port 138 UDP) to function. Port 139 should never be exposed to untrusted networks. SMBv1 has critical vulnerabilities including MS17-010 (EternalBlue) that enabled WannaCry ransomware to propagate across networks. Modern Windows versions disable SMBv1 by default and use SMB over TCP port 445 directly.

Security risks

  • 1MS17-010 / EternalBlue (CVE-2017-0144): The exploit behind WannaCry and NotPetya ransomware – remote code execution on SMBv1 via NetBIOS/port 139. Affected every unpatched Windows system worldwide
  • 2Null session enumeration: connecting to port 139 with empty credentials reveals user lists, share names, group memberships, and password policies on unpatched Windows systems
  • 3Pass-the-Hash: captured NTLM hashes (from network sniffing or SAM dumps) authenticate directly over port 139/445 without knowing the plaintext password
  • 4SMBv1 protocol weaknesses: no encryption, weak authentication, susceptible to relay attacks (NTLM relay), and man-in-the-middle modification of file contents in transit
  • 5NetBIOS name service interaction: port 139 requires NetBIOS name resolution (ports 137/138) which is vulnerable to poisoning attacks (Responder, LLMNR/NBT-NS spoofing)

Firewall guidance

Block port 139 at the internet perimeter unconditionally – there is never a legitimate reason for internet-facing NetBIOS. Internally: disable SMBv1 (Set-SmbServerConfiguration -EnableSMB1Protocol $false) and prefer port 445 (direct SMB). For modern Windows (10+), NetBIOS over TCP/IP can be disabled entirely in network adapter settings.

Diagnosis commands

Check if target is vulnerable to EternalBlue (MS17-010)

shell
nmap -p 139 --script smb-vuln-ms17-010 target

Enumerate users, shares, policies via NetBIOS null session

shell
enum4linux -a target

List shares without credentials (null session test)

shell
smbclient -L //target -N

PowerShell: check if SMBv1 is enabled (should be False)

shell
Get-SmbServerConfiguration | Select EnableSMB1Protocol

Usage examples

Port 139 – NetBIOS Session
shell
nmap -p 139 target
smbclient -L //host -p 139
net use \\host\share

Common services on this port

Windows File Sharing (legacy)Samba (Linux SMB)macOS SMB (legacy mode)Printers via SMB

Related ports

445

SMB direct (no NetBIOS layer)

137

NetBIOS Name Service (UDP)

138

NetBIOS Datagram Service

3389

RDP (often targeted together with SMB)

History

NetBIOS (Network Basic Input/Output System) was created by IBM in 1983 for LAN communication. Port 139 carries the Session Service – originally designed for small office LANs. Microsoft built SMBv1 file sharing on top of NetBIOS. Windows 2000 introduced 'direct hosting' (SMB over TCP/445, no NetBIOS needed). EternalBlue (leaked from NSA in 2017) exploited SMBv1 on port 139/445 causing billions in damage via WannaCry and NotPetya.

FAQ

Port 139 vs port 445 – what is the difference?

Port 139: SMB over NetBIOS Session Service (legacy, requires NetBIOS name resolution on ports 137/138). Port 445: SMB directly over TCP (modern, no NetBIOS layer needed). Windows 2000+ supports both; Windows 10+ defaults to 445. Port 139 exists for backward compatibility with pre-Windows 2000 systems. If all your systems are Windows 2000+, you can disable NetBIOS entirely.

Is it safe to run Samba on port 139 internally?

Only if: (1) SMBv1 is disabled (smb.conf: min protocol = SMB2), (2) port 139 is restricted to trusted subnets via hosts allow, (3) NTLM is disabled in favor of Kerberos authentication. Better: configure Samba on port 445 only (smb.conf: disable netbios = yes) and ensure clients use DNS/WINS instead of NetBIOS name resolution.