HackBlue

Tools · Nmap and network discovery · 25 / 25

Found RDP or SMB open in a scan? How to verify and close it

Turn an Nmap finding of exposed 3389 or 445 into a confirmed, fixed, and retested change on hosts you manage.

11 min read · practice only with authorization

Why these two ports come up first

Remote Desktop on 3389 and SMB on 445 are among the most common entry points in ransomware cases. RDP exposed to the internet invites password guessing and has had serious pre-authentication bugs. SMB exposed beyond the local network was the path for the WannaCry worm in 2017. Internally, both are legitimate, but they should only be reachable from the systems that need them.

The finding is reachability from a vantage point. The fix is to make reachability match need.

Verify before you ask for a change

Rescan the single port with -sV and --reason from the same source, so you know it is still open and what answers. For RDP, rdp-ntlm-info returns the host’s NetBIOS and DNS names, which helps confirm the owner. For SMB, smb-os-discovery and smb2-security-mode give name and signing status.

Then find the owner through DNS, the CMDB, or the name the scripts returned, and confirm whether the exposure is intended.

Snippet
sudo nmap -sV --reason -p 3389 --script rdp-ntlm-info 203.0.113.25
sudo nmap -sV --reason -p 445 --script smb-os-discovery,smb2-security-mode 10.10.4.0/24

Fixes in order of preference

For RDP from the internet: remove the port forward or security group rule, and put access behind a VPN or a remote desktop gateway with MFA. Enable Network Level Authentication and an account lockout policy regardless. For internal RDP, restrict it with Windows Defender Firewall scope to admin jump hosts.

For SMB: block 445 at the network edge in both directions, disable SMBv1 everywhere, and restrict workstation-to-workstation SMB with host firewalls so one infected laptop cannot reach every other laptop.

Snippet
# PowerShell on the host: allow RDP only from a jump host
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 10.10.1.5
Get-SmbServerConfiguration | Select EnableSMB1Protocol, RequireSecuritySignature
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

Lab: close and retest

On a Windows lab VM, enable Remote Desktop and confirm Nmap sees 3389 open from your scanner. Apply the firewall scope rule so only a different lab address can reach it, then rescan from the scanner and expect filtered. Rescan from the allowed address and expect open.

Save both scans and attach them to the change record. Retesting from both the denied and allowed side proves the rule does what it says without breaking legitimate access.

Diagram

From finding to closed ticket

  1. Confirm

    Rescan one port with -sV and --reason from the same source.

  2. Identify

    Use rdp-ntlm-info or smb-os-discovery to find the host name and owner.

  3. Fix

    Remove exposure, scope firewall rules, disable SMBv1, require NLA.

  4. Retest

    Scan from a denied and an allowed source; attach both.

Check yourself

1. What is the preferred fix for RDP exposed to the internet?

2. Which NSE script helps identify the Windows host name behind an exposed RDP port?

3. How do you prove a new firewall scope rule works without breaking access?