Port reference
Port 445 (TCP) – SMB / CIFS
Server Message Block — Windows file/printer sharing and the primary AD lateral-movement channel.
Default state
Open on virtually all Windows hosts and domain controllers. Frequently and dangerously exposed to the internet.
Common attacks
- EternalBlue / MS17-010 pre-auth RCE (CVE-2017-0144)
- SMB relay (NTLM relay to SMB/LDAP)
- Null-session and share enumeration
- Ransomware lateral movement and encryption over shares
Hardening
- Disable SMBv1; require SMBv3 with encryption
- Enforce SMB signing to defeat relay attacks
- Never expose 445 to the internet
- Restrict anonymous/null access and apply least-privilege share ACLs
- Patch MS17-010 and SMBGhost (CVE-2020-0796) promptly
nmap snippet
nmap -p445 --script smb-vuln-ms17-010,smb-enum-shares,smb-os-discovery <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 445?
Port 445 is the modern home of SMB (Server Message Block), also known as CIFS — the protocol Windows uses for file and printer sharing, named pipes, and inter-process communication. Since Windows 2000 it runs SMB directly over TCP, replacing the older NetBIOS transport on port 139. It is one of the most important ports in any Active Directory environment and is present on essentially every Windows host.
Why it matters for security
SMB is the connective tissue of Windows networks, which makes 445 a top target. It is the channel for EternalBlue (MS17-010 / CVE-2017-0144), the wormable pre-auth RCE behind WannaCry and NotPetya, and for SMBGhost (CVE-2020-0796). It also underpins NTLM relay: captured authentication can be relayed to SMB or LDAP to seize a host or escalate in the domain. And once inside, ransomware uses 445 to move laterally and encrypt file shares at scale.
How it's attacked
Attackers enumerate shares and null sessions to map data and trust, then exploit MS17-010 for unauthenticated code execution on unpatched hosts. Where SMB signing is off, coerced or captured NTLM authentication is relayed to take over other machines. After a foothold, operators spread ransomware host to host over reachable shares — the dominant lateral-movement pattern in modern intrusions.
Hardening checklist
Disable SMBv1 and require SMBv3 with encryption. Enforce SMB signing domain-wide to break relay attacks. Never expose 445 to the internet — keep it internal and segment it. Restrict anonymous access and apply least-privilege share ACLs. Patch MS17-010 and SMBGhost immediately. The nmap scripts above check for MS17-010 and enumerate shares on hosts you are authorized to test.
Related ports
Frequently asked questions
- Is it safe to expose port 445 to the internet?
- No. Internet-exposed SMB is a top ransomware and worm vector — EternalBlue spread this way. Keep 445 internal only, behind a VPN, with SMBv1 disabled.
- What is EternalBlue?
- EternalBlue (MS17-010 / CVE-2017-0144) is a wormable SMBv1 pre-auth RCE used by WannaCry and NotPetya to spread across networks via port 445.