Null Session Countermeasure

--Null sessions require access to TCP 139 and/ or TCP 445 ports.

--You could also disable SMB services entirely on individual hosts by unbinding WINS Client TCP/IP from the interface.

--Edit the registry to restrict the anonymous user.

     -----Open regedt32, navigate to            HKLM\SYSTEM\CurrentControlSet\LSA

     -----Choose edit | add value

          value name: ResticAnonymous

          Data Type: REG WORD

          Value: 2

 "HKLM" refers to the hive "HKEY_LOCAL_MACHINE". If this is set to "1" anonymous connections are restricted. However, an anonymous user can still connect to the IPC$ share, though he is restricted as to which information is obtainable through that connection. A value of "1" restricts anonymous users from enumerating SAM accounts and shares. A Value of "2", added in Windows 2000, restricts all anonymous access unless clearly granted. Therefore, the first registry key to check would be:

HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous

The other keys to inspect are:

HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters \NullSessionShares

and HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes

These are MULTI_SZ (multi-line string) registry parameters that list the shares and pipes, respectively, that are open to null sessions. These keys should be verified so that no unwarranted shares or pipes are open. Moreover, those open should be secured such that only 'SYSTEM' or "Administrators' have access to modifying these keys.

In Windows 2000, the domain security policy lays down the protection measures for the domain controller. On systems that are not domain controllers, the 'Local Security Policy' must be configured to restrict anonymous connections. The value "No access without explicit anonymous permission" is the most secure and the equivalent of 2 in the registry value of the key HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous discussed above.

Another step that is advisable is to disallow remote access completely except for specific accounts and groups. It would be prudent to block NetBIOS ports on the firewall or border router to increase network security. Blocking the following ports will prevent against Null Sessions (as well as other attacks that use NetBIOS)

135 TCP DCE/RPC Portmapper

137 TCP/UDP NetBIOS Name Service

138 TCP/UDP NetBIOS Datagram Service

139 TCP NetBIOS Session Service

445 TCP Microsoft-DS (Windows 2000 CIFS/SMB)

A best practice that comes in handy is to stop all services that are not otherwise required for the functioning of the system.

NetBIOS Enumeration

---NBTscan is a program for scanning IP networks for NetBIOS name information.

---For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.

---The first thing a remote attacker will try on a Windows 2000 network is to get list of hosts attached to the wire.

     net view / domain,

     nbstat -A

If an attacker notes a windows OS with port 139 open, he would be interested in checking what resources he can access or view on the remote system. This is shown in the screenshot above. However, to enumerate the NetBIOS names, the remote system must have enabled File and Printer Sharing.

Using these techniques the attacker can launch two types of attack on the remote computer having NetBIOS. He can choose to read/write to a remote computer system depending on the availability of shares. Alternatively he can launch a denial of service.

A recent instance was reported in August 2002 when Microsoft issued an advisory stating that an attacker could seek to exploit an unchecked buffer in network share provider on machines that have anonymous access enabled by sending a malformed SMB request to a target computer and crashing it.

 Attack Methods-  Let us adopt an attacker's perspective to his port scan results.

On finding port 139 open, the attacker can first use the nbtstat command

Usage: nbtstat [-a RemoteName] [-A IP_address] [-c] [-n] [-R] [-r] [-S] [-s] [interval]

Note that an attacker will take particular interest in the id <03>. We try to connect to this remote machine using a null session. Usage: net use \\IP\IPC$ "" /user: "" This command connects to the machine using a null user and null password as signified by the empty quotes. The IPC$ is the hidden share on the particular IP that we will try to access in order to list any shared resources. Two main drawbacks of nbtstat are that it is restricted to operating on a single user and its rather inscrutable output. The tool NBTScan addresses these issues.

 Tools  A tool that can be used for such exploits is NBTScan written by Alla Bezroutchko and available at http://www.inetcat.org/software/nbtscan.html. NBTscan is a program for scanning IP networks for NetBIOS name information. It sends NetBIOS status query to each address in supplied range and lists received information in human readable form. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address. NBTscan uses port 137 UDP for sending queries. If the port is closed on destination host destination will reply with ICMP "Port unreachable" message. See screenshot below.

Hacking Tool:DumpSec

DumpSec, presently available as freeware from SomarSoft and downloadable at http://www.systemtools.com/somarsoft/, is a security auditing program for Windows systems. It dumps the permissions (DACLs) and audit settings (SACLs) for the file system, registry, printers and shares in a concise, readable listbox (text) format, so that holes in system security are readily apparent. DumpSec also dumps user, group and replication information.

DumpSec takes advantage of the NetBIOS API and works by establishing NULL session to the target box as the Null user via the [net use \\server "" /user:""] command. It then makes NET* enumeration application program interface (API) calls like NetServerGetInfo (supported by the Netapi32 library).

It allows users to remotely connect to any computer and dump permissions, audit settings, and ownership for the Windows NT/2000 file system into a format that is easily converted to Microsoft Excel for editing. Hackers can choose to dump either NTFS or share permissions. It can also dump permissions for printers and the registry.

The highlight is DumpSec's ability to dump the users and groups in a Windows NT or Active Directory domain. There are several reporting options and the hacker can choose to dump the direct and nested group memberships for every user, as well as the logon scripts, account status such as disabled or locked out, and the 'true' last logon time across all domain controllers. The user can also get password information such as 'Password Last Set Time' and 'Password Expires Time'. To summarize, Dumpsec can pull a list of users, groups, and the NT system's policies and user rights.

Hacking Tool: NAT

The NetBIOS Auditing Tool (NAT) is designed to explore the NetBIOS file-sharing services offered by the target system.

It implements a stepwise approach to gather information and attempt to obtain file system-level access as though it were a legitimate local client.

If a NETBIOS session can be established at all via TCP port 139, the target is declared "vulnerable".

Once the session is fully set up, transactions are performed to collect more information about the server including any file system "shares" it offers.

Once the session is fully set up, transactions are performed to collect more information about the server including any file system "shares" it offers.

Attempts are then made to connect to all listed file system shares and some potentially unlisted ones. If the server requires passwords for the shares, defaults are attempted as described above for session setup. Any successful connections are then explored for writeability and some known file-naming problems.

If a NETBIOS session can be established at all via TCP port 139, the target is declared "vulnerable" with the remaining question being to what extent.

Information is collected under the appropriate vulnerability at most of these steps, since any point along the way be blocked by the security configurations of the target. Most Microsoft-OS based servers and Unix SAMBA will yield computer names and share lists, but not allow actual file-sharing connections without a valid username and/or password. A remote connection to a share is therefore a possibly serious security problem, and a connection that allows writing to the share almost certainly so. Let's take a look at an output from NAT.exe

C:\nat>nat 192.168.2.176

[*]--- Checking host: 192.168.2.176

[*]--- Obtaining list of remote NetBIOS names

[*]-- Remote systems name tables:

                                         JOHN

                                         WORKGROUP

                                         JOHN

                                         JOHN

                                         WORKGROUP

.................

[*]--- Attempting to connect with name: JOHN

[*]--- CONNECTED with name: JOHN

.................

[*]--- Attempting to establish session 

[*]--- Obtained server information:

Server= [JOHN] User= [] Workgroup= [WORKGROUP] Domain= [WORKGROUP]

[*]--- Obtained listing of shares:

     Sharename      Type     Comment 

     ---------      ----     ------

     D              Disk:

     IPC$           IPC:     Remote Inter Process Communication

[*]--- Attempting to access share: \\JOHN\D

[*]--- WARNING: Able to access share: \\JOHN\D

[*]--- Checking write access in: \\JOHN\D

[*]--- WARNING: Directory is writeable: \\JOHN\D

[*]--- Attempting to exercise... bug on: \\JOHN\D

ALL NetBIOS Tools Available @ http://www.cotse.com/tools/netbios.htm

http://www.tux.org/pub/security/secnet/tools/nat10/

http://www.softpedia.com/get/Network-Tools/Network-Testing/Essential-NetTools.shtml

    http://www.softpedia.com/get/Network-Tools/Network-Testing/

Identifying Accounts

Two powerful NT/2000 enumeration tools are:
sid2user
user2sid
They can be downloaded at (www.chem.msu.su/^rudnyi/NT/)
These are command line tools that look up NT SIDs from username input and vice versa.


user2sid and sid2user are two small utilities for Windows NT/2000 that allows the user to query SAM and to find out a SID value for a given account name and vice versa. These utilities are actually command line interfaces to WIN32 functions, LookupAccountName and LookupAccountSid. It happens that to use these functions a user have just to be EVERYONE. It means that an ordinary user can find without a problem a built-in domain administrator name, which MS recommends us to rename from administrator to something else.
User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine Sid2user.exe can then be used to retrieve the names of all the user accounts and more. Windows NT/2000 keeps track of User accounts and groups with Security Identifiers or SIDs. All SIDs are unique within a given system and are issued by what is known as an "Authority" such as a domain. There are five authorities:
SECURITY_NULL_SID_AUTHORITY (null user)
SECURITY_WORLD_SID_AUTHORITY (everyone)
SECURITY_LOCAL_SID_AUTHORITY (local user)
SECURITY_CREATOR_SID_AUTHORITY (creator owner /group)
SECURITY_NT_AUTHORITY
Note the default SIDs that captures a cracker's interest.


Administrator S-1-5-21-<........................>-500 and Guest S-1-5-21-<........................>-501


Domain Admins S-1-5-21-<........................>-512


Domain Users S-1-5-21-<........................>-513

Domain Guest S-1-5-21-<........................>-514
Let us take a look at the attack.
Here we try for the default built-in Administrator account - and we get access to more information such as domain and number of sub authorities.
Had we found the default guest account, we could escalate it to the Administrators group by changing the RID using the sid2user.
c:\>sid2user \\196.xxx.xxx.xx 5 21 1123561549 1788223846 725345447 500
This will change the guest account to that of an administrator account. The last three digits (here 500) is the registered ID. Once a RID has been issued it will never be used again. Any group or user that is not created by default will have a RID of 1000 or greater.
Net use, user2sid and sid2user all operate over TCP port 139 - NetBIOS session. The reason why these utilities work despite having ACLs in place is that LookupAccountName and LookupAccountSID don't have ACL on them.

SNMP Enumeration

SNMP is simple. Managers send requests to agents, and the agents send back replies. The requests and replies refer to variables accessible to agent software.
Managers can also send requests to set values for certain variables.
Traps let the manager know that something significant has happened at the agent's end of things:
---a reboot
---an interface failure,
---or that something else that is potentially bad has happened.
Enumerating NT users via SNMP protocol is easy using snmputil
SNMP consists primarily of two objects: a manager and an agent. An agent consists of a piece of software embedded in a machine. SNMP agents exist for almost any piece of equipment. However, the installed agent doesn't do anything for the machine until queried by the manager. This is separate program that a network manager runs on their own computer that queries the agent (across the network) for information.
The default community string that provides the monitoring or read capability is often "public". The default management or write community string is often "private". The SNMP exploit takes advantage of these default community strings to allow an attacker to gain information about a device using the read community string "public", and the attacker can change a systems configuration using the write community string "private".
SNMPutil example


The security threat comes from Windows 2000 servers and workstations having SNMP support enabled and failing to change the default read-only community string 'Public'. However, changing this does not exempt it from attackers sniffing it from the network or to subjecting it to a dictionary or brute force attack. This may not seem troublesome but the Windows 2000 SNMP variables contain a wealth of information for the sniffing cracker. Some of the tables that are available when one has READ access to the SNMP tree in a Windows 2000 box are listed below:
Interface Table - This table identifies all boxes with multiple interfaces, plus useful details like their IP and MAC addresses.
Route Table and ARP Table - With access to these tables, a cracker can quickly build an accurate picture of a network and continue its search for vulnerabilities.
TCP Table and UDP Table - These will show which TCP and UDP ports are actively used, and on which ports services are listening for new clients.
Device Table and Storage Table - Knowing what hardware is attached to a Windows 2000 machine gives crackers clues about what kind of machine it is dealing with.
Process Table and Software Table - Knowing what software are installed and what software is running (DNS server, DHCP server) gives away details about how to attack the system. They even show which service packs have been installed (and missing patches)
User Table - Knowing which user names are valid on a machine makes it much easier to guess passwords and gain access to a system.
Share Table - If the cracker knows what shares are exported and used by a Windows machine, it can lead to a serious security compromise.
Here, we will look at an SNMP utility called SNMPutil.exe which is a part of the Windows 2000 resource kit. Let us take a look at what we can discover with it from the command line prompt.
In this output, the variable is called 1.3.6.1.2.1.1.2.0, and we 'get' its value, which turns out to be 1. The variable name (1.3.6.1.2.1.1.2.0) is called an object identifier or OID. An alternative to this is found in the second line of the output shown here. The 'interfaces.ifNumber.o' is the same OID, but is more easily readable. The second and third arguments to SNMPUTIL designate the host to which the SNMP request will be sent (210.212.69.129), and community (authentication string or password) to use (public). The 'public' community is the default when SNMP support is installed on a Windows 2000 host, and it allows the user to read all variables present. Since even the number of interfaces in a host is sensitive data, the threat is evident. Let us look at some of the other variables that might be of interest to an attacker and a security professional.
IpForwarding (1.3.6.1.2.1.4.1.0) - Is the host forwarding? This is not a good sign for a workstation.
IcmpInRedirects (1.3.6.1.2.1.5.7) - Is the host redirecting icmp messages?
TcpOutRsts (1.3.6.1.2.1.6.15) - A counter indicating the number of RSTs send by the box. This counter will increase rapidly when port-scanned.
UdpNoPorts (1.3.6.1.2.1.7.2) - A counter indicating traffic to ports where no service was present. Also a possible port-scan signal.
SNMP walk automates the whole process of getting the variables and can be redirected to an output file. To summarize, Snmputil can reveal details about services that are running, share names, share paths, any comments on shares, usernames and domain names etc.
SNMP Enumeration Countermeasures
Simplest way to prevent such activity is to remove the SNMP agent or turn off the SNMP service.
If shutting off SNMP is not an option, then change the default 'public' community name.
Implement the Group Policy security option called Additional restrictions for anonymous connections.
Access to null session pipes and null session shares, and IPSec filtering should also be restricted.

SNMP Enumeration Countermeasures

Countermeasure Do not install the management and monitoring windows component if it is not going to be used. In case it is required ensure that only legally authorized persons have access to it else, it might turn into an obvious backdoor. Edit the Registry to permit only approved access to the SNMP community Name.
Countermeasure Change 'community' to properly configured ones - preferably with private community names (not the default "public"). Where possible, restrict access to SNMP agent. By restriction, we mean allowing SNMP requests from only specific addresses. Additionally, these requests should be restricted to read-only wherever possible. All these configurations can be done by changing the properties of the 'SNMP Service' (Start/Administrative Tools/Services).
Countermeasure Authenticate/Encrypt using IPSEC - SNMP (V1) may not have adequate authentication and encryption facilities built in but this is where IPSec can come to the rescue. IPSec policies can be defined in the monitored systems and management stations so that all SNMP traffic is authenticated and/or encrypted.
Coutermeasure Collect Traps - If SNMP is enabled, monitor the Windows 2000 event logs. Effective auditing can actually raise the level of security