Introduction to NULL sessions

• NULL sessions have already been discussed in the past

  • Still, interesting and new things to discuss

• NULL sessions are used to anonymously call RPC operations on a remote system

  • NULL sessions are unauthenticated SMB sessions
  • SMB is Windows core network protocol, not to be confused with NetBIOS!
  • SMB operates over
    • 139/TCP (NetBIOS over TCP/IP transport)
    • 445/TCP (raw SMB transport, directly into TCP)
  • Recent Windows systems also run RPC services over TCP/IP
    • It is also possible to anonymously call RPC operations over TCP/IP