Analyze Null Session Detection Using PCAP for QID 70003

The QID 70003 (Null Session/Password NetBIOS Access) is triggered when the scanner appliance successfully establishes an SMB null session with the target system. In some cases, the scan results display the message “No Results are available,” making it difficult to determine whether the detection is a true positive. Null sessions are commonly associated with legacy SMB implementations and typically involve access to the IPC$ share without authentication. Allowing anonymous SMB access is a significant security misconfiguration because it permits unauthenticated connections to the target system. You can use PCAP analysis to validate the detection and confirm whether the target accepts anonymous SMB session requests.

Cause

The target system allows SMB null session access. The scanner appliance successfully establishes an SMB session without credentials by using the anonymous user account.

Solution

1. Run a Packet Capture (PCAP) scan to analyze the SMB communication between the scanner appliance and the target system.

   If the option to initiate a PCAP scan is not visible on the UI, contact customer support for assistance.

2. Review the SMB session setup request in the PCAP output.
3. Locate the packet in which the scanner appliance initiates the null session attempt.
   Example: Packet #3055.

4. Verify the following details:

   • The scanner appliance sends an SMB request to the target system over TCP port 445.

   • The SMB command is Session Setup AndX Request (command code: 0x73).

   • The username field contains anonymous.

   • The security blob is empty or minimal because no credentials are provided.

   • The negotiated SMB dialect may show an older version such as NT LM 0.12.

   • The request attempts to establish an unauthenticated SMB session with the target.

5. Review the SMB response from the target system.
   Example: Packet #3060
6. Verify the following details:
   • The target returns an SMB Session Setup AndX Response (command code: 0x73).
   • The response status is STATUS_SUCCESS (NT Status Code: 0x00000000).
   • The session is established for the anonymous user.
   • The server assigns a Session UID for the SMB session.
   • The scanner may subsequently attempt a Tree Connect AndX Request to the IPC$ share.
7. Confirm the vulnerability.
   A successful SMB Session Setup AndX Response with STATUS_SUCCESS confirms that the target permits null session access and validates the detection as a true positive.

Good to know

Server Message Block (SMB) Protocol