445端口也是一种TCP端口,该端口在 Windows 2000 Server或Windows Server 2003系统中发挥的作用与139端口是完全相同的。具体地说,它也是提供局域网中文件或打印机共享服务。不过该端口是基于CIFS协议(通用因特网文件系统协议)工作的,而139端口是基于SMB协议(Server Message Block服务器协议族)对外提供共享服务。
使用137, 138 (UDP) and 139 (TCP)来实现基于TCP/IP的NETBIOS网际互联。
在Windows NT中SMB基于NBT实现。而在Windows2000中,SMB除了基于NBT的实现,还有直接通过445端口实现。
当Win2000(允许NBT)作为client来连接SMB服务器时,它会同时尝试连接139和445端口,如果445端口有响应,那么就发送RST包给139端口断开连接,以455端口通讯来继续.当445端口无响应时,才使用139端口。
当Win2000(禁止NBT)作为client来连接SMB服务器时,那么它只会尝试连接445端口,如果无响应,那么连接失败。(注意可能对方是NT4.0服务器。)
如果win2000服务器允许NBT, 那么UDP端口137, 138, TCP 端口 139, 445将开放。
如果 NBT 被禁止, 那么只有445端口开放。
消息格式:SMB Message分为三个部分
- SMB Header, //头部
4byte - SMB Command Header//命令头部
32byte - the Data Block. //数据部分
SMB 头部
数据结构:
typedef unsigned char UCHAR;
typedef unsigned short USHORT;
typedef unsigned long ULONG;
typedef struct {
} LARGE_INTEGER;
typedef struct
client use
} SMB_HEADER;
说明:
1、Tid
Tid represents an instance of an authenticated connection to a server resource.
returns Tid to the client when the client successfully connects to a resource, and the client uses Tid in subsequent requests referring to the resource.
2、Pid Pid is the caller's process id, and is generated by the client to uniquely identify a process within the client computer.
3、Uid Field
Uid is a reference number assigned by the server after a user authenticates to it, and that it will associate with that user until the client requests the association be broken. After authentication to the server, the client SHOULD make sure that the Uid is not used for a different user that the onethat authenticated. (It is permitted for a single user to have more than one Uid.) Requests that do authorization, such as open requests, will perform access checks using the identity associated with the Uid.
4、 Mid Field
The multiplex ID (Mid) is used along with the Pid to allow multiplexing the single client and server connection among the client's multiple processes, threads, and requests per thread. Clients may have many outstanding requests (up to the negotiated number, MaxMpxCount) at one time. Servers MAY respond to requests in any order, but a response message MUST always contain the same Mid and Pid values as the corresponding request message. The client MUST NOT have multiple outstanding requests to a server with the same Mid and Pid.
5、command code
(1)SMB_COM_NEGOTIATE
(2)SMB_COM_SESSION_SETUP_ANDX
SMB_COM_SESSION_SETUP_ANDX
(3)SMB_COM_NT_CREATE_ANDX
SMB_COM_NT_CREATE_ANDX
(4)SMB_COM_READ_AndX
SMB_COM_READ_AndX
An SMB_COM_READ_ANDX request is sent by a client to read from a file or named pipe on a server
(5)
SMB_COM_WRITE_AndX
An SMB_COM_WRITE_AndX request is sent by a client to write from