bugtraq - Re: Authentication flaw in microsoft SMB protocol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030422152424.5633.qmail@www.securityfocus.com>
Date: 22 Apr 2003 15:24:24 -0000
From: Chris Wysopal <cwysopal@...take.com>
To: bugtraq@...urityfocus.com
Subject: Re: Authentication flaw in microsoft SMB protocol

In-Reply-To: <909EB55D24CCFD4D9ABABD1B9BD610C609F5DBD8@...-msg-06.redmond.corp.microsoft.com>

On Mon, 21 Apr 2003, Jesper Johansson wrote:

>You don't need to wait. This is prevented with NTLM v.2, which shipped
>with Windows NT 4.0 SP4 in October 1998. This type of attack is also
>foiled with Kerberos, which is negotiated by default in a Windows 2000
>or higher domain.

While this is true, in this attack it is a malicious server which makes 
the client configuration important.  Unless LMCompatabilitylevel has been 
changed from its default of 0 or "Send LM & NTLM responses" this attack 
should still work.  This is the default on Windows 2000 and XP.

>To learn more about using NTLM v.2 and Kerberos, refer to the Windows
>2000 Security Hardening Guide:
>http://www.microsoft.com/technet/security/prodtech/Windows/Win2kHG.asp

The hardening guide recommends setting this level as high as possible and 
there really isn't any reason these days not to run an NTLMv2 client 
environment by setting this LMCompatability level to 3 or higher.  This 
can be done through a domain security policy.  It is also a good idea to 
filter TCP ports 139 and 445 outbound on your perimeter if possible.

-Chris