CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// File transfer & sharing

Port 445: SMB

Windows file and printer sharing, also used for remote administration (PsExec, admin shares).

Server Message BlockCIFSmicrosoft-dsWindows file sharing
445

How SMB works

File transfer & sharing
client:4451/32/33/3report.docxSTARTTLS if negotiated client:4451/32/33/3report.docxSTARTTLS if negotiated

Files are sent over port 445 in pieces and reassembled on the other side. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).

Transport
TCP · UDP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
File transfer & sharing
01 Security

Is port 445 dangerous?

Common attacks and weaknesses

  • Wormable vulnerabilities: EternalBlue (MS17-010, WannaCry, NotPetya) and SMBGhost (CVE-2020-0796).
  • NTLM relay and credential theft, lateral movement with admin shares.
  • Anonymous shares leaking data.

How to secure it

  • Block 445 at the Internet edge, always.
  • Disable SMBv1, require SMB signing and use SMB encryption where possible.
  • Restrict admin shares and segment workstations from each other.
02 Registry

IANA registry entries for port 445

ServicePortTransportDescriptionReferenceUpdated
microsoft-ds 445 TCP, UDP Microsoft-DS - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 445, and is it reachable?

Linux

sudo ss -ltnup 'sport = :445'      # process listening on 445
sudo lsof -nP -i :445

macOS

sudo lsof -nP -i :445

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 445 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 445
netstat -ano | findstr :445

From another machine

nmap -p 445 -sV <host>
sudo nmap -sU -p 445 <host>
nc -zv <host> 445

Block it in the firewall

sudo ufw deny 445/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 445" -Direction Inbound -LocalPort 445 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 445 used for?

Windows file and printer sharing, also used for remote administration (PsExec, admin shares).

Is port 445 TCP or UDP?

Port 445 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 445?

It is rated 9/10 (critical) when exposed to the Internet. Wormable vulnerabilities: EternalBlue (MS17-010, WannaCry, NotPetya) and SMBGhost (CVE-2020-0796). Block 445 at the Internet edge, always.

How do I check if port 445 is open?

On Linux run "ss -ltnup 'sport = :445'", on macOS "lsof -nP -i :445", and on Windows "netstat -ano | findstr :445" to see the local process. From another machine, "nmap -p 445 <host>" shows whether it is reachable.

05 Related
:21 FTP tcp · udp · sctp · high risk :139 NetBIOS Session tcp · udp · high risk :69 TFTP udp · tcp · high risk :2049 NFS tcp · udp · sctp · high risk :873 rsync tcp · udp · high risk :20 File Transfer [Default Data] tcp · udp · sctp :115 Simple File Transfer Protocol tcp · udp :152 Background File Transfer Program tcp · udp

Latest vulnerability news

All news