ADDOM-017: NTLMv2 Enforcement
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check reads the LmCompatibilityLevel DWORD at HKLM\SYSTEM\CurrentControlSet\Control\Lsa on every domain controller via remote registry or WinRM. It also resolves the effective Group Policy that sets the value by parsing the GptTmpl.inf for the "Network Security: LAN Manager authentication level" entry under [Registry Values] within every GPO linked to the Domain Controllers OU and the domain root. Guerrilla evaluates the lowest precedence-winning value across the resultant set and compares it to 5. Mapping of the seven defined values: 0 = Send LM and NTLM responses, 1 = Send LM and NTLM, use NTLMv2 session security if negotiated, 2 = Send NTLM response only, 3 = Send NTLMv2 response only, 4 = Send NTLMv2 response only, refuse LM, 5 = Send NTLMv2 response only, refuse LM and NTLM. Any value 0 through 4 is a finding. The check also reads NoLmHash (1 prevents storing the LM hash of new passwords in the SAM) and the companion settings NTLMMinClientSec and NTLMMinServerSec under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 because LmCompatibilityLevel alone does not enforce 128-bit session security or message integrity.
Por qué importa
When a domain controller or member server accepts NTLMv1 or LM, every authentication that traverses it can be downgraded by an attacker positioned to intercept the negotiation. The LM response is keyed by a 7-byte half of a 14-byte uppercased password padded with nulls; tools like hashcat recover it in seconds. NTLMv1 derives three DES keys from the 16-byte NT hash and encrypts an 8-byte server challenge; when the attacker controls the challenge (relay or rogue server scenario, often via Responder with --lm or --challenge 1122334455667788) the response can be cracked deterministically against rainbow tables hosted at crack.sh, returning the NT hash itself within hours. That NT hash is a pass-the-hash primitive: it can be replayed via SMB, WinRM, WMI, or used to forge silver and golden tickets, request service tickets via S4U2Self, and pivot laterally without ever cracking the cleartext password. The blast radius for a downgraded domain controller is the krbtgt of any account that authenticated to it, including service accounts and Tier 0 administrators. Even when LM/NTLMv1 traffic is rare in normal operation, leaving the policy permissive guarantees that any relay or coercion primitive (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce) will succeed in dropping a hash that an attacker can break.
Ruta de ataque
Step 1: Position. The attacker gains a foothold on the LAN, either through an endpoint compromise or by joining a rogue device. They start Responder.py -I eth0 -wrf with --lm to advertise LM-only support and poison LLMNR, mDNS, and NBT-NS broadcasts. Concurrently they enumerate domain controllers and use Get-DomainPolicy or direct registry reads to confirm LmCompatibilityLevel is below 5. Step 2: Coercion. The attacker triggers authentication from a target server or DC to their host using a coercion primitive: PetitPotam (MS-EFSRPC EfsRpcOpenFileRaw), PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx), DFSCoerce (MS-DFSNM NetrDfsRemoveStdRoot), or ShadowCoerce (MS-FSRVP). The target sends an NTLM Type 1 negotiate to the attacker. Step 3: Downgrade. The attacker responds with an NTLM Type 2 challenge containing the static 8-byte value 1122334455667788 and clears the NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY flag. Because the target policy permits NTLMv1, the target computes the NTLMv1 response over the static challenge and sends NTLM Type 3 back to the attacker. Step 4: Capture. Responder logs the username, domain, and three DES-encrypted blocks of the NT hash. The format looks like USER::DOMAIN:LMRESP:NTRESP:1122334455667788. Step 5: Crack. The attacker uploads the captured response to crack.sh, which uses a precomputed rainbow table over the full DES keyspace and returns the original NT hash within hours (typically free for non-commercial use, paid for guaranteed turnaround). Alternative: hashcat -m 5500 against a local cluster. Step 6: Pass the hash. With the NT hash the attacker authenticates as the target via Impacket psexec.py, wmiexec.py, or evil-winrm using -H <nthash>. If the target is a computer account they can request a TGT with Rubeus asktgt /user:DC01$ /rc4:<nthash>, then S4U2Self or RBCD their way into administrator context. Combined with ADCS web enrollment (PetitPotam plus ADCS HTTP) this is the classic ESC8 chain into Domain Admin.
Cómo lo evalúa Guerrilla
Guerrilla connects to every domain controller returned by Get-ADDomainController and binds to HKLM via the remote registry service or WinRM. It reads four values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa: LmCompatibilityLevel, NoLmHash, NtlmMinClientSec, and NtlmMinServerSec. In parallel it enumerates every GPO linked at the domain root and the Domain Controllers OU via Get-GPO, downloads the SecEdit GptTmpl.inf from \\<domain>\SYSVOL\<domain>\Policies\{GUID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, and parses the [Registry Values] block for "MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel". The check resolves GPO precedence (link order, Enforced flag, Block Inheritance) to compute the effective value that will apply to a freshly joined DC. A finding is raised when the effective value is below 5 on any DC or when no GPO enforces the value at all (relying on local registry alone). The check additionally inspects the NTLM auditing values (RestrictSendingNTLMTraffic, AuditReceivingNTLMTraffic, AuditNTLMInDomain) and notes whether telemetry is being collected so the operator can scope a deprecation plan.
Valor recomendado
LAN Manager authentication level set to 'Send NTLMv2 response only. Refuse LM & NTLM' (level 5)
Remediación
Configure via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > 'Network security: LAN Manager authentication level' = 'Send NTLMv2 response only. Refuse LM & NTLM'. Test thoroughly before enforcement
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(2), SC-8
- CIS Benchmark
- 2.3.8.4
- ANSSI
- R27
- NSA / ASD
- NTLM-2
- CIS AD Benchmark
- 2.3.2
- MITRE ATT&CK
- T1557, T1003