ADDOM-017: Imposición de NTLMv2
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El nivel de autenticación de LAN Manager debe configurarse para enviar únicamente respuestas NTLMv2 y rechazar LM y NTLMv1. Aunque NTLMv2 sigue siendo menos seguro que Kerberos, es significativamente más robusto que NTLMv1 y debe ser el estándar mínimo de NTLM
Por qué importa
When a domain controller or member server accepts NTLMv1 or LM, every authentication that traverses it can be downgraded by an attacker positioned to intercept the negotiation. The LM response is keyed by a 7-byte half of a 14-byte uppercased password padded with nulls; tools like hashcat recover it in seconds. NTLMv1 derives three DES keys from the 16-byte NT hash and encrypts an 8-byte server challenge; when the attacker controls the challenge (relay or rogue server scenario, often via Responder with --lm or --challenge 1122334455667788) the response can be cracked deterministically against rainbow tables hosted at crack.sh, returning the NT hash itself within hours. That NT hash is a pass-the-hash primitive: it can be replayed via SMB, WinRM, WMI, or used to forge silver and golden tickets, request service tickets via S4U2Self, and pivot laterally without ever cracking the cleartext password. The blast radius for a downgraded domain controller is the krbtgt of any account that authenticated to it, including service accounts and Tier 0 administrators. Even when LM/NTLMv1 traffic is rare in normal operation, leaving the policy permissive guarantees that any relay or coercion primitive (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce) will succeed in dropping a hash that an attacker can break.
Ruta de ataque
Step 1: Position. The attacker gains a foothold on the LAN, either through an endpoint compromise or by joining a rogue device. They start Responder.py -I eth0 -wrf with --lm to advertise LM-only support and poison LLMNR, mDNS, and NBT-NS broadcasts. Concurrently they enumerate domain controllers and use Get-DomainPolicy or direct registry reads to confirm LmCompatibilityLevel is below 5. Step 2: Coercion. The attacker triggers authentication from a target server or DC to their host using a coercion primitive: PetitPotam (MS-EFSRPC EfsRpcOpenFileRaw), PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx), DFSCoerce (MS-DFSNM NetrDfsRemoveStdRoot), or ShadowCoerce (MS-FSRVP). The target sends an NTLM Type 1 negotiate to the attacker. Step 3: Downgrade. The attacker responds with an NTLM Type 2 challenge containing the static 8-byte value 1122334455667788 and clears the NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY flag. Because the target policy permits NTLMv1, the target computes the NTLMv1 response over the static challenge and sends NTLM Type 3 back to the attacker. Step 4: Capture. Responder logs the username, domain, and three DES-encrypted blocks of the NT hash. The format looks like USER::DOMAIN:LMRESP:NTRESP:1122334455667788. Step 5: Crack. The attacker uploads the captured response to crack.sh, which uses a precomputed rainbow table over the full DES keyspace and returns the original NT hash within hours (typically free for non-commercial use, paid for guaranteed turnaround). Alternative: hashcat -m 5500 against a local cluster. Step 6: Pass the hash. With the NT hash the attacker authenticates as the target via Impacket psexec.py, wmiexec.py, or evil-winrm using -H <nthash>. If the target is a computer account they can request a TGT with Rubeus asktgt /user:DC01$ /rc4:<nthash>, then S4U2Self or RBCD their way into administrator context. Combined with ADCS web enrollment (PetitPotam plus ADCS HTTP) this is the classic ESC8 chain into Domain Admin.
Cómo lo evalúa Guerrilla
Guerrilla connects to every domain controller returned by Get-ADDomainController and binds to HKLM via the remote registry service or WinRM. It reads four values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa: LmCompatibilityLevel, NoLmHash, NtlmMinClientSec, and NtlmMinServerSec. In parallel it enumerates every GPO linked at the domain root and the Domain Controllers OU via Get-GPO, downloads the SecEdit GptTmpl.inf from \\<domain>\SYSVOL\<domain>\Policies\{GUID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, and parses the [Registry Values] block for "MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel". The check resolves GPO precedence (link order, Enforced flag, Block Inheritance) to compute the effective value that will apply to a freshly joined DC. A finding is raised when the effective value is below 5 on any DC or when no GPO enforces the value at all (relying on local registry alone). The check additionally inspects the NTLM auditing values (RestrictSendingNTLMTraffic, AuditReceivingNTLMTraffic, AuditNTLMInDomain) and notes whether telemetry is being collected so the operator can scope a deprecation plan.
Valor recomendado
Nivel de autenticación de LAN Manager establecido en 'Enviar solo respuesta NTLMv2. Rechazar LM y NTLM' (nivel 5)
Remediación
Configure mediante directiva de grupo: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Opciones de seguridad > 'Seguridad de red: nivel de autenticación de LAN Manager' = 'Enviar solo respuesta NTLMv2. Rechazar LM y NTLM'. Pruebe exhaustivamente antes de la imposición
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(2), SC-8
- CIS Benchmark
- 2.3.8.4
- ANSSI
- R27
- NSA / ASD
- NTLM-2
- CIS AD Benchmark
- 2.3.2
- MITRE ATT&CK
- T1557, T1003