Port reference
Port 139 (TCP) – NetBIOS Session Service
NetBIOS Session Service — legacy transport for SMB file and printer sharing over NetBIOS.
Default state
Open on Windows hosts with NetBIOS over TCP/IP enabled. Largely superseded by direct SMB on 445 but still present on legacy systems.
Common attacks
- Null-session enumeration of users, shares, and policies
- SMB relay and credential capture
- EternalBlue / MS17-010 exploitation against SMBv1
- Ransomware lateral movement over file shares
Hardening
- Disable SMBv1 entirely
- Disable NetBIOS over TCP/IP and prefer SMB on 445 with signing
- Block null sessions (restrict anonymous access)
- Enforce SMB signing to defeat relay
- Block TCP 139 at the network boundary
nmap snippet
nmap -p139 --script smb-os-discovery,smb-enum-shares <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 139?
Port 139 is the NetBIOS Session Service, the legacy transport that carries SMB (Server Message Block) file and printer sharing over NetBIOS. Before Windows 2000 introduced direct SMB on port 445, all Windows file sharing rode on 139. It remains open on hosts that still have NetBIOS over TCP/IP enabled and is often paired with the NetBIOS Name Service on UDP 137.
Why it matters for security
Port 139 exposes the same SMB attack surface as 445 but tied to older, weaker defaults. Legacy SMBv1 carried the EternalBlue vulnerability (MS17-010 / CVE-2017-0144) weaponized by WannaCry and NotPetya. The service also historically permitted null sessions — unauthenticated connections that enumerate users, groups, shares, and password policy — handing attackers a detailed map of the domain before they have any credentials.
How it's attacked
Attackers run null-session enumeration to harvest users, shares, and policy, then either crack discovered accounts or relay captured NTLM authentication to other hosts. Against unpatched SMBv1 systems, EternalBlue (MS17-010) gives remote code execution with no credentials, and ransomware then spreads laterally across reachable file shares.
Hardening checklist
Disable SMBv1 everywhere — it has no safe use today. Disable NetBIOS over TCP/IP and consolidate on SMB over 445 with signing enforced. Restrict anonymous access to kill null sessions, enforce SMB signing to defeat relay, and block TCP 139 at network boundaries. Patch MS17-010 immediately on any remaining legacy host. The nmap scripts above enumerate OS and shares on systems you are authorized to test.
Related ports
Frequently asked questions
- What is the difference between port 139 and 445?
- Port 139 runs SMB over the legacy NetBIOS Session Service, while 445 runs SMB directly over TCP. Modern Windows prefers 445; 139 persists for backward compatibility.
- Is port 139 a security risk?
- Yes. It enables legacy SMBv1, null-session enumeration, and credential relay, and was a vector for EternalBlue-based worms like WannaCry.