nmap smb-brute questions

Hi All,

In the following "#" is my command prompt for "root".

I have been testing a script called "smb-brute":
     http://nmap.org/nsedoc/scripts/smb-brute.html

I have some confusion.  On the web page, there are two
examples:

      nmap --script smb-brute.nse -p445 <host>
      sudo nmap -sU -sS --script smb-brute.nse -p U:137,T:139 <host>

When I look at my /etc/services, I get the following smb
services:

       netbios-ns      137/tcp  # NETBIOS Name Service
       netbios-ns      137/udp
       netbios-dgm     138/tcp  # NETBIOS Datagram Service
       netbios-dgm     138/udp
       netbios-ssn     139/tcp  # NETBIOS session service
       netbios-ssn     139/udp
       microsoft-ds    445/tcp
       microsoft-ds    445/udp

Question 1):  Why is the example only checking UDP:137,
and TCP:139?  Ports 137,138,139,445 are all using both
UDP and TCP according to /etc/services.  Is the example
not meant to be a good example?


When I scan my KVM Windows Frankenstein (w8) virtual machine,
I get back:

    # nmap --script smb-brute.nse  -p 137,138,139,445 192.168.255.116
    ...
    PORT    STATE  SERVICE
    137/tcp closed netbios-ns
    138/tcp closed netbios-dgm
    139/tcp open   netbios-ssn
    445/tcp open   microsoft-ds

But when I scan the ports directly without the script, I
get back:

    # nmap --reason -Pn -p 137,138,139,445 192.168.255.116
    ...
    PORT    STATE    SERVICE      REASON
    137/tcp filtered netbios-ns   no-response
    138/tcp filtered netbios-dgm  no-response
    139/tcp filtered netbios-ssn  no-response
    445/tcp filtered microsoft-ds no-response

Question 2): why is one "closed and open" and the other
one "filtered"?  How is it that the script can find open
ports and the direct command can not?


Question 3): on the first above scan, had it found any or
broke any hashes, would it have told me?


On the following command, I also get back:
    # nmap --script smb-brute.nse  -p 137,138,139,445 192.168.255.116
    ...
    Host script results:
    | smb-brute:
    |   administrator:<blank> => Valid credentials, account disabled
    |_  guest:<blank> => Valid credentials, account disabled

Question 4): does the "Valid credentials, account disabled" mean
the script could not break in?

Many thanks,
-T


-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------