I am preparing for some of the Offensive Security certifications and digging through many unix tools and networking protocols and fundamentals.
While trying to enumerate a target machine's SMB service, I tripped over a non-standard port configuration.
Instead of the standard SMB ports 139 (SMB over NetBIOS over TCP) and 445 (SMB over TCP), the SMB service listened on some other ports.
I was using enum4linux-ng and was irritated that it provided no option for setting the port to use when connecting to SMB. Under the hood, enum4linux-ng uses smbclient (and rpcclient for some enumerations). The smbclient manpage clearly says that it's possible to select the port via the smbclient -p flag.
After quickly hacking the enum4linux-ng source and changing the SMB port (also adding it to some command invocations), I could successfully enumerate and grab the flag for this machine.
The next day, I decided to do the right thing and created a feature request to add some port flags to enum4linux-ng.
Turns out the maintainer (who guided me through this in the most helpful way) already tried that some time ago. Together we figured out (again) that it is (currently) impossible to make smbclient talk "SMB over NetBIOS" to any other port than 139.
After trying to get some help from #samba IRC community, someone pointed out that this was a strange thing to do (it really is) and that I could use DNAT (via iptables or nftables) to translate the outgoing traffic to a port of my choice.
This is not an ideal solution because it requires root permission, but it did solve my problem. The following rule redirects all traffic towards port 139 to port 44139 (regardless of the destination IP):
table ip nat {
chain output {
type nat hook output priority filter + 1; policy accept;
# replace 44139 with the port you would like the SMB via NetBIOS traffic to be redirected to
tcp dport 139 redirect to :44139
}
}