Patriotbox Guide: Unbind NetBIOS ports.

One of the secrets to success in the operation of Honeypots is the ability to lock down the server as best as possible. This guide will talk about how to unbind the NetBIOS ports. These ports include UDP 137, 138 and TCP 139 and 445.

TCP port 139 and UDP ports 137 and 138. These ports are actually easy to unbind. To do this you need to open up your Network Properties, then select TCP/IP and hit the properties tab.

Next you will Click on the Advanced Tab.

Next Click on the WINS Tab.

Now Select "Disable NetBIOS over TCP/IP.

Click ok. You are now done and your system will no longer listen on TCP port 139 and UDP ports 137 and 138.

Port 445 is not so easy and their are 2 different ways to unbind the port.

The first way Involves going into registry and browsing to this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\

Next look for the Value Name: TransportBindName and rename it to something else example; TransportBindName11

Close out of the registry Editor and reboot the system.

Second method involves opening up your Hardware Device manager. Once the device manager is open click on menu option "view" and select "show hidden devices"

Next expand "Non-Plug and Play Drivers" and highlight NetBios over Tcpip. Right click it and select disable. Reboot system.

This concludes the guide. If you have any questions please contact us at support@alkasis.com