Port 445 – SMB / CIFS

TCP

Port 445 is the SMB (Server Message Block) port for Windows file sharing, printer access, and named pipes. SMB on port 445 runs directly over TCP without NetBIOS. Exposing port 445 to the internet is critically dangerous – EternalBlue (MS17-010), WannaCry, and NotPetya all exploited SMB vulnerabilities.

Port Number

445

Protocol

TCP

Service

Server Message Block

Range

IANA Well-Known (0–1023)

Description

SMB over TCP port 445 is the standard for Windows file and printer sharing since Windows 2000. It replaced the NetBIOS-dependent port 139 by running SMB directly over TCP. Modern systems negotiate SMBv3 with encryption (AES-128-GCM) when both endpoints support it. Port 445 is consistently in the top 3 most attacked ports on the internet. Beyond file sharing, SMB named pipes on port 445 enable remote procedure calls used by Active Directory, Windows management tools, and lateral movement techniques. Enterprise firewalls should block port 445 at the perimeter and restrict it internally to domain controllers and file servers only.

Security risks

1MS17-010 / EternalBlue (CVE-2017-0144): SMBv1 remote code execution exploited by WannaCry (230,000 machines, $4B damage) and NotPetya ($10B damage). Still being scanned for daily on port 445
2CVE-2020-0796 (SMBGhost): SMBv3.1.1 compression RCE – wormable vulnerability in Windows 10/Server 2019 allowing unauthenticated remote code execution via crafted SMB packet
3NTLM relay attacks: attacker intercepts SMB authentication and relays it to another service (LDAP, Exchange, MSSQL). Tools: Responder + ntlmrelayx achieve domain admin in minutes on misconfigured networks
4Ransomware propagation: port 445 is the primary lateral movement vector for ransomware (Ryuk, Conti, LockBit) – once one machine is compromised, SMB propagates to all reachable shares
5SMB signing disabled: without SMB signing (disabled by default on non-DCs), man-in-the-middle attacks can modify file contents in transit and inject malicious payloads into executables being accessed

Firewall guidance

NEVER expose port 445 to the internet – this is the single most dangerous port to expose on a Windows network. Internally: disable SMBv1 (Windows Feature removal), require SMB signing (Set-SmbServerConfiguration -RequireSecuritySignature $true), enable SMB encryption for sensitive shares (Set-SmbShare -Name 'share' -EncryptData $true). Segment file servers from workstation subnets.

Diagnosis commands

Enumerate supported SMB protocol versions (SMBv1 should not be present)

shell

nmap -p 445 --script smb-protocols target

Test null session share enumeration (should fail if anonymous access is disabled)

shell

crackmapexec smb target --shares -u '' -p ''

PowerShell: audit SMB server security settings

shell

Get-SmbServerConfiguration | Select EnableSMB1Protocol,RequireSecuritySignature,EncryptData

Check if target is vulnerable to EternalBlue

shell

nmap -p 445 --script smb-vuln-ms17-010 target

Usage examples

Port 445 – SMB / CIFS

shell

smbclient -L //host -U user
net use Z: \\server\share
nmap --script smb-vuln-ms17-010 -p 445 target

Common services on this port

Windows File Sharing (SMB2/SMB3)Samba (Linux/macOS)Azure Files SMBDFS (Distributed File System)Windows Print Spooler

Related ports

139

NetBIOS Session (legacy SMB)

445

SMB direct (this port)

3389

RDP (commonly targeted together)

5985

WinRM (Windows remote management)

History

SMB (Server Message Block) was created by IBM in 1983, adopted by Microsoft for Windows networking. Port 445 was introduced in Windows 2000 for 'direct hosting' – SMB over TCP without the NetBIOS layer. CIFS (Common Internet File System) was Microsoft's 1996 rename. SMB2 (2006, Vista) and SMB3 (2012, Windows 8/Server 2012) added encryption, reduced chattiness, and multi-channel. EternalBlue (2017) remains the most impactful exploit in SMB history.

FAQ

How do I completely disable SMBv1?

Windows Server: Remove-WindowsFeature FS-SMB1. Windows 10/11: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. Verify: Get-SmbServerConfiguration | Select EnableSMB1Protocol (should be False). Also check client-side: sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi and Set-SmbClientConfiguration -EnableSMB1Protocol $false. Samba: min protocol = SMB2 in smb.conf.

Is it safe to expose SMB3 to the internet with encryption?

No. Even with SMB3 encryption: (1) the authentication handshake exposes NTLM hashes (crackable offline), (2) brute-force attacks against credentials are trivial, (3) zero-days like SMBGhost affect even SMB3, (4) exposing 445 invites automated scanning. Always use VPN (WireGuard, OpenVPN) or Azure Files with private endpoints for remote file access. SMB is a LAN protocol – treat it as such.

Specification

RFC 5661 – Port 445 specification →