9 votes
Accepted

Find SMBv1 status with Nmap

There is not currently a script to check for this. It would be a trivial change to the existing smbv2-enabled script. Currently, the script has three possible outputs: No output: SMB of any version ...
bonsaiviking's user avatar
  • 11.7k
7 votes
Accepted

What do emails have to do with the spread of WannaCrypt?

According to Craig Williams of Cisco the reason for the email infection-rumour was another new attack that happened almost at the same time as WannaCry: A likely point of confusion was the Jaff ...
techraf's user avatar
  • 9,149
7 votes

What do emails have to do with the spread of WannaCrypt?

Many organizations don't have SMB directly exposed to the internet, but SMB is widely used internally by organizations. It is believed that the initial attack vector for WannaCry was /is a malicious ...
DKNUCKLES's user avatar
  • 9,237
5 votes
Accepted

What to do if you still have SMBv1 running on your network?

The real fix First of all, I would strongly recommend to only focus on convincing the decision makers that it is very irresponsible to continue the use of Windows Server 2003 in production ...
Bob Ortiz's user avatar
  • 6,665
5 votes
Accepted

How to check if Windows computer has SMB accessible over the internet?

If your port 445/tcp is exposed to the outside then your SMB is accessible over internet. This usually requires port forwarding and your public/private IP must be reachable from the outside. (...
Soufiane Tahiri's user avatar
4 votes

Responder SMBv2 and cracking

This issue has been fixed in the latest release (2.3.3.1). The challenge sent was not the one displayed. In the future, please take the time to send us a bug report on github: https://github.com/...
lgandx's user avatar
  • 41
4 votes
Accepted

Is it risky to allow SMB traffic to the Internet

I'm not sure what operating system you are using, or if/what firewalls you have implemented, but exposing the SMB service with unfiltered access from the internet is asking to be compromised. Also, ...
SuperAdmin's user avatar
4 votes

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now?

Stuxnet spread by leveraging vulnerabilities MS08-067 and MS10-061, which were patched in 2008 and 2010 respectively. https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/...
myron-semack's user avatar
4 votes
Accepted

What harm is there in obtaining password hashes in a Windows environment?

TL;DR: Because of how Windows authenticates network users in a non-Kerberos (non-Active Directory) scenarios, password hashes work just as well as passwords for authenticating network users. Long ...
Josh Kelley's user avatar
3 votes

What harm is there in obtaining password hashes in a Windows environment?

getting hashes is not the same as obtaining actual passwords It can be just as good as obtaining the actual passwords, though, for typical users. This article is about workers at power companies. Do ...
Ben's user avatar
  • 4,032
3 votes
Accepted

How dangerous is SMBv1?

There are a number of CVEs against SMBv1 including: Arbitrary Code Execution CVE-2017-0148 Denial of Service CVE-2017-0280 So it comes down to what is an acceptable risk for you, and do you try to ...
Joe M's user avatar
  • 3,002
3 votes
Accepted

Responder mitigation

Can this be mitigated by requiring SMB signing by clients on the network? i.e. Would this prevent the client from sending its response to the authentication challenge because the authentication ...
SilverlightFox's user avatar
3 votes
Accepted

My system is being attacked or it is attacking

Reading the alert you have windows file sharing turned on(CIFS) and another machine 114.50 tried to connect and use an exploit related to CVE-2017-0144 . It would appear from the alert 114.50 is ...
Joe M's user avatar
  • 3,002
3 votes
Accepted

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

An exploit is making use of a vulnerability to perform an unintended action. So an exploit may execute code without going through an authentication flow or a variety of other actions. This is why ...
McMatty's user avatar
  • 3,260
3 votes
Accepted

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now?

Presumably Microsoft developed the patches for Windows XP and 2003 for their paying customers at the same time as the patches for 7+, i.e. in/for March. They then decided to release them for free, ...
Douglas Leeder's user avatar
3 votes

Is it risky to allow SMB traffic to the Internet

There is a risk of exposing your credentials via broken SMB NTLMSSP_NEGOTIATE implementation, as descibed here: https://www.cybersecurity-help.cz/blog/167.html
Valery Marchuk's user avatar
3 votes

EternalBlue exploit doesn't work against windows 8

Just because it doesn't work for you doesn't mean it's safe. You should patch your box. If you are running an unpatched Windows 8 box, don't expect to be safe. There's a lot of reasons why it may ...
Mark Buffalo's user avatar
  • 22.6k
3 votes

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

how secure is my setup? 0-day exploits notwithstanding you're secure as long as your users/passwords combinations are secure as well and you install Windows updates immediately after they are ...
Artem S. Tashkinov's user avatar
2 votes
Accepted

Effective blocking of SMB connections on AsusWRT

Most consumer routers have a single port that goes to the WAN and Four (or other) ports dedicated to the LAN. In the case of the AsusWRT it appears as though those four ports are switched and not ...
DKNUCKLES's user avatar
  • 9,237
2 votes
Accepted

EternalBlue exploit doesn't work against windows 8

Eternalblue works fine when smb connection to the victim is established. However, default Windows 8 and later installation without additional service info: - anonymous is not allowed to access any ...
Os Tiger's user avatar
2 votes

Find SMBv1 status with Nmap

I was able to make a semi-functional smbv1-enabled.nse by taking the smbv2-enabled script and removing all the other dialects, leaving only NT LM .12 Remember that SMBv1 is really NT LM .12 Once you ...
AprilMJ's user avatar
  • 21
2 votes

Find SMBv1 status with Nmap

There's a script called smb-vuln-ms08-067 & smb-vuln-cve2009-3103 contrary to what other answers were. You can use this via nmap -sU --script smb-vuln-ms08-067.nse -p U:137 <host> or nmap --...
Shritam Bhowmick's user avatar
2 votes

Is it risky to allow SMB traffic to the Internet

Yes it is risky. While I don't know about any "exploits" that may be out there in the wild, what I do know is that anybody with the right username and password could get access to the disk drives ...
SDsolar's user avatar
  • 977
2 votes

Security risks of file shares vs ssh or sftp, in "backward" direction?

The real question is how does ransom ware spread. This might seem counter intuitive, but over the last two decades there have been numerous problems with SMB that have resulted in worms, ransomware, ...
Jonathan's user avatar
  • 2,346
2 votes
Accepted

Is it possible to block psexec without blocking regular SMB access?

For psexec to work, you must already have local admin credentials for the target. If you don't want people using psexec to a given computer, the proper solution is to not give them admin rights there. ...
Joseph Sible-Reinstate Monica's user avatar
1 vote
Accepted

Samba and verifying server identity

Unfortunately, this is not possible in your situation. When you want the client and the server both to verify each other's identity, this is called "mutual authentication". Per this MSDN post, NTLM ...
DoubleD's user avatar
  • 3,942
1 vote

How to close port 445 (Apple Time Capsule smbd)

Don't trust random devices to be secure. Instead, implement a firewall between 'the internet' and your device, and make sure to block this unrequired traffic at the firewall level. Apple have ...
djsmiley2kStaysInside's user avatar
1 vote
Accepted

Is it possible to execute an executable with authenticated SMB?

While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation. This is because the ADMIN$ and C$ shares are not accessible without ...
Saustin's user avatar
  • 311
1 vote

Is it safe to install MS17-010 unpatched OS as guest on patched host?

If the guest is unpatched and has the vulnerability present then yes it is vulnerable. If the guest has any of its interfaces NAT’ed or Bridged to an unprotected network then the guest is exploitable ...
TheJulyPlot's user avatar
  • 7,809
1 vote

SMBRelay Attack - Mount Share instead of Code Execution

Yes, but for mounting shares you only need to use the NTLM Relay aka NTLM Reflection attack, not the full SMB Relay code-execution attack. Due to the fleeting nature of NET-NTLMv2 authentication, I ...
atdre's user avatar
  • 19.1k

Only top scored, non community-wiki answers of a minimum length are eligible