Penetration Testing mailing list archives
Re: Avoid sending current credentials automatically over the network
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Thu, 15 Feb 2007 08:51:59 -0800
Not necessarily. Windows has SSP's for Kerberos, NTLM, and Schannel. While Windows will try to use the "most secure" (Kerberos) first, there are any number of circumstances where NT(LM) will be used instead, such as remote access to a resource where both systems are not members of the same domain or trusted domains, time synchronization is off by more than five minutes, or when the remote resource simply requests a particular type of authentication. That's why you should specify to only send NTLMv2 and to refuse LM and NTLM in your local windows security policy. t On 2/14/07 9:07 AM, "McCarty, Eric C." <emccarty () er ucsd edu> spoketh to all:
"However over the network there is no option to avoid sending current users creds automatically" First off, I don't know the type of environment you are working in but windows uses Kerberos for authentication purposes: Kerberos differs from username/password authentication methods because instead of authenticating each user to each network service, it uses symmetric encryption and a trusted third party - known as the Key Distribution Center (KDC) - to authenticate users to a suite of network services. Once a user authenticates to the KDC, it sends a ticket specific to that session back the user's machine and any kerberized services look for the ticket on the user's machine rather than asking the user to authenticate using a password. As a result you are not really sending uname/pword over the wire. However I see your point in wanting to avoid using Kerberos, the easiest way is to specify a guest user when mapping Net use \\server\share /USER:Guest You can also disable Kerberos using a registry change : To disable Kerberos, Microsoft provides a registry hack (the hack is available from Windows 2000 Service Pack 2 onward). The hack is called NT4Emulator (REG_DWORD) and should be added to the HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Netlogon/ Parameters registry key of the Windows 2000 SP2 or later DC and set to value 1. Eric -----Original Message----- From: Shenk, Jerry A [mailto:jshenk () decommunications com] Sent: Tuesday, February 13, 2007 3:00 PM To: Umil; pen-test () securityfocus com Subject: RE: Avoid sending current credentials automatically over the network I would recommend blocking those ports (135, 137, 139 and 445) at the edge router so that at least they aren't sent over the internet. For some machines, perhaps you want a host firewall to block them from leaving the box at all. -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Umil Sent: Tuesday, February 13, 2007 10:21 AM To: pen-test () securityfocus com Subject: Avoid sending current credentials automatically over the network Hi all When mapping a network share without any credentials parameter or when clicking in a link for a internal app Windows and IE automatically send the current users credentials automatically. Aparently for IE you can configure to send anonymous creds (guest account) and then ask for creds. However over the network there is no option to avoid sending current users creds automatically. I tried smb signing but it didn't work. Does anyone know a solution for it? Thanks Uno ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016 00000008bOW ------------------------------------------------------------------------ **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016 00000008bOW ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016000000 08bOW ------------------------------------------------------------------------
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Avoid sending current credentials automatically over the network Umil (Feb 13)
- RE: Avoid sending current credentials automatically over the network Shenk, Jerry A (Feb 13)
- RE: Avoid sending current credentials automatically over the network Gadi Evron (Feb 14)
- <Possible follow-ups>
- RE: Avoid sending current credentials automatically over the network McCarty, Eric C. (Feb 15)
- Re: Avoid sending current credentials automatically over the network Thor (Hammer of God) (Feb 15)
- Re: Avoid sending current credentials automatically over the network Thor (Hammer of God) (Feb 17)
- RE: Avoid sending current credentials automatically over the network Shenk, Jerry A (Feb 13)