Exploiting NULL session

With PC Firewall:
C:\>nmap -sU -sA -p1-1000 192.168.10.165

Starting Nmap 4.76 ( http://nmap.org ) at 2008-11-26 15:38 Eastern Standard Tim

Interesting ports on 192.168.10.165:
Not shown: 1000 open|filtered ports, 997 filtered ports
PORT STATE SERVICE
135/tcp unfiltered msrpc
139/tcp unfiltered netbios-ssn
445/tcp unfiltered microsoft-ds
MAC Address: 00:1E:68:D5:58:72 (Quanta Computer)

Nmap done: 1 IP address (1 host up) scanned in 14.69 seconds
C:\>net use \\192.168.10.165\IPC$ "" /u:""
System error 53 has occurred.


Without PC Firewall
C:\>nmap -sU -sS -p1-1000 192.168.10.165

Starting Nmap 4.76 ( http://nmap.org ) at 2008-11-26 15:35 Eastern Standard Time

Interesting ports on 192.168.10.165:
Not shown: 1990 closed ports
PORT STATE SERVICE
9/tcp filtered discard
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
9/udp open|filtered discard
123/udp open|filtered ntp
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
445/udp open|filtered microsoft-ds
500/udp open|filtered isakmp
MAC Address: 00:1E:68:D5:58:72 (Quanta Computer)

Nmap done: 1 IP address (1 host up) scanned in 8.80 seconds

C:\>net use \\192.168.10.165\IPC$ "" /u:""
The command completed successfully.

C:\>net view \\192.168.10.165
System error 5 has occurred.

Access is denied.

Probably means that the following registry key is set to 1:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\RestrictAnonymous

If it's set to 0 (and no firewall), you get the following output instead:

Simple conversion of nmap output in XML to CSV using XSLT

Here's a simple nmap.xsl file to include in the same directory as the nmap XML output file (replace all curly braces with the greater/smaller than signs):

{?xml version="1.0" encoding="UTF-8"?}
{xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:fo="http://www.w3.org/1999/XSL/Format"}
{xsl:output method="html" indent="yes" encoding="UTF-8"/}
{xsl:template match="/nmaprun"}host,protocol,port,service,state,
{xsl:apply-templates select="host"} {/xsl:apply-templates}
{/xsl:template}
{xsl:template match="host"}
{xsl:for-each select="ports/port"}
{xsl:value-of select="../../hostnames/hostname/@name"/},{xsl:value-of select="@protocol"/},{xsl:value-of select="@portid"/},{xsl:value-of select="service/@name"/},{xsl:value-of select="state/@state"/},
{/xsl:for-each}
{xsl:apply-templates/}
{/xsl:template}
{/xsl:stylesheet}

On Windows
1. Run nmap. For example: nmap.exe -T3 -sS -sV -p1-9000 -oX nmap-out.xml 10.10.1.1-254
2. Convert the file by using: msxsl nmap-out.xml nmap.xsl -o nmap-out.csv

I'm about to test the same thing on Linux...

To download the msxsl utility, go here