9
votes
Accepted
Find SMBv1 status with Nmap
There is not currently a script to check for this. It would be a trivial change to the existing smbv2-enabled script. Currently, the script has three possible outputs:
No output: SMB of any version ...
- 11.8k
7
votes
Accepted
What do emails have to do with the spread of WannaCrypt?
According to Craig Williams of Cisco the reason for the email infection-rumour was another new attack that happened almost at the same time as WannaCry:
A likely point of confusion was the Jaff ...
- 9,159
7
votes
What do emails have to do with the spread of WannaCrypt?
Many organizations don't have SMB directly exposed to the internet, but SMB is widely used internally by organizations.
It is believed that the initial attack vector for WannaCry was /is a malicious ...
- 9,227
5
votes
Accepted
What to do if you still have SMBv1 running on your network?
The real fix
First of all, I would strongly recommend to only focus on convincing the decision makers that it is very irresponsible to continue the use of Windows Server 2003 in production ...
- 7,075
5
votes
Accepted
How to check if Windows computer has SMB accessible over the internet?
If your port 445/tcp is exposed to the outside then your SMB is accessible over internet. This usually requires port forwarding and your public/private IP must be reachable from the outside.
(...
- 2,677
4
votes
Responder SMBv2 and cracking
This issue has been fixed in the latest release (2.3.3.1).
The challenge sent was not the one displayed.
In the future, please take the time to send us a bug report on github: https://github.com/...
- 41
4
votes
Accepted
Is it risky to allow SMB traffic to the Internet
I'm not sure what operating system you are using, or if/what firewalls you have implemented, but exposing the SMB service with unfiltered access from the internet is asking to be compromised.
Also, ...
- 330
4
votes
WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now?
Stuxnet spread by leveraging vulnerabilities MS08-067 and MS10-061, which were patched in 2008 and 2010 respectively.
https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/...
- 538
4
votes
Accepted
What harm is there in obtaining password hashes in a Windows environment?
TL;DR: Because of how Windows authenticates network users in a non-Kerberos (non-Active Directory) scenarios, password hashes work just as well as passwords for authenticating network users.
Long ...
- 342
3
votes
What harm is there in obtaining password hashes in a Windows environment?
getting hashes is not the same as obtaining actual passwords
It can be just as good as obtaining the actual passwords, though, for typical users. This article is about workers at power companies. Do ...
- 4,082
3
votes
Accepted
How dangerous is SMBv1?
There are a number of CVEs against SMBv1 including:
Arbitrary Code Execution CVE-2017-0148
Denial of Service CVE-2017-0280
So it comes down to what is an acceptable risk for you, and do you try to ...
- 3,012
3
votes
Accepted
Responder mitigation
Can this be mitigated by requiring SMB signing by clients on the
network? i.e. Would this prevent the client from sending its response
to the authentication challenge because the authentication ...
- 34.4k
3
votes
Accepted
My system is being attacked or it is attacking
Reading the alert you have windows file sharing turned on(CIFS) and another machine 114.50 tried to connect and use an exploit related to CVE-2017-0144 . It would appear from the alert 114.50 is ...
- 3,012
3
votes
Accepted
Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?
An exploit is making use of a vulnerability to perform an unintended action.
So an exploit may execute code without going through an authentication flow or a variety of other actions. This is why ...
- 3,270
3
votes
Accepted
WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now?
Presumably Microsoft developed the patches for Windows XP and 2003 for their paying customers at the same time as the patches for 7+, i.e. in/for March.
They then decided to release them for free, ...
- 2,004
3
votes
Is it risky to allow SMB traffic to the Internet
There is a risk of exposing your credentials via broken SMB NTLMSSP_NEGOTIATE implementation, as descibed here: https://www.cybersecurity-help.cz/blog/167.html
- 546
3
votes
EternalBlue exploit doesn't work against windows 8
Just because it doesn't work for you doesn't mean it's safe. You should patch your box.
If you are running an unpatched Windows 8 box, don't expect to be safe.
There's a lot of reasons why it may ...
- 22.6k
3
votes
How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?
how secure is my setup?
0-day exploits notwithstanding you're secure as long as your users/passwords combinations are secure as well and you install Windows updates immediately after they are ...
- 3,501
2
votes
Accepted
Effective blocking of SMB connections on AsusWRT
Most consumer routers have a single port that goes to the WAN and Four (or other) ports dedicated to the LAN. In the case of the AsusWRT it appears as though those four ports are switched and not ...
- 9,227
2
votes
Accepted
EternalBlue exploit doesn't work against windows 8
Eternalblue works fine when smb connection to the victim is established.
However, default Windows 8 and later installation without additional service info:
- anonymous is not allowed to access any ...
- 46
2
votes
Find SMBv1 status with Nmap
I was able to make a semi-functional smbv1-enabled.nse by taking the smbv2-enabled script and removing all the other dialects, leaving only NT LM .12
Remember that SMBv1 is really NT LM .12
Once you ...
- 21
2
votes
Find SMBv1 status with Nmap
There's a script called smb-vuln-ms08-067 & smb-vuln-cve2009-3103 contrary to what other answers were. You can use this via nmap -sU --script smb-vuln-ms08-067.nse -p U:137 <host> or nmap --...
- 1,600
2
votes
Is it risky to allow SMB traffic to the Internet
Yes it is risky.
While I don't know about any "exploits" that may be out there in the wild, what I do know is that anybody with the right username and password could get access to the disk drives ...
- 977
2
votes
Security risks of file shares vs ssh or sftp, in "backward" direction?
The real question is how does ransom ware spread. This might seem counter intuitive, but over the last two decades there have been numerous problems with SMB that have resulted in worms, ransomware, ...
- 2,386
2
votes
Accepted
Is it possible to block psexec without blocking regular SMB access?
For psexec to work, you must already have local admin credentials for the target. If you don't want people using psexec to a given computer, the proper solution is to not give them admin rights there. ...
1
vote
Accepted
Samba and verifying server identity
Unfortunately, this is not possible in your situation.
When you want the client and the server both to verify each other's identity, this is called "mutual authentication".
Per this MSDN post, NTLM ...
- 3,970
1
vote
How to close port 445 (Apple Time Capsule smbd)
Don't trust random devices to be secure.
Instead, implement a firewall between 'the internet' and your device, and make sure to block this unrequired traffic at the firewall level. Apple have ...
1
vote
Accepted
Is it possible to execute an executable with authenticated SMB?
While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation.
This is because the ADMIN$ and C$ shares are not accessible without ...
- 321
1
vote
Is it safe to install MS17-010 unpatched OS as guest on patched host?
If the guest is unpatched and has the vulnerability present then yes it is vulnerable. If the guest has any of its interfaces NAT’ed or Bridged to an unprotected network then the guest is exploitable ...
- 7,859
1
vote
SMBRelay Attack - Mount Share instead of Code Execution
Yes, but for mounting shares you only need to use the NTLM Relay aka NTLM Reflection attack, not the full SMB Relay code-execution attack.
Due to the fleeting nature of NET-NTLMv2 authentication, I ...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible