Why would an attacker try to create a null session with a computer on a network?

Maurine is working as a security consultant for Hinklemeir Associates. She has asked the Systems Administrator to create a group policy that would not allow null sessions on the network. The Systems Administrator is fresh out of college and has never heard of null sessions and does not know what they are used for. Maurine is trying to explain to the Systems Administrator that hackers will try to create a null session when footprinting the network.
Why would an attacker try to create a null session with a computer on a network?

A.
To create a user with administrative privileges for later use

B.
Enumerate users and shares

C.
Install a backdoor for later attacks

D.
Escalate his/her privileges on the target server

Explanation:
The Null Session is often referred to as the “Holy Grail” of Windows hacking. Listed as the number 5 windows vulnerability on the SANS/FBI Top 20 list, Null Sessions take advantage of flaws in the CIFS/SMB (Common Internet File System/Server Messaging Block) architecture. You can establish a Null Session with a Windows (NT/2000/XP) host by logging on with a null user name and password. Using these null connections allows you to gather the following information from the host:
– List of users and groups
– List of machines
– List of shares
– Users and host SID’ (Security Identifiers)