ADDOM-018: Null Session Enumeration
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the four registry values on HKLM\SYSTEM\CurrentControlSet\Control\Lsa that control anonymous access posture: RestrictAnonymous (DWORD, expected 1), RestrictAnonymousSAM (DWORD, expected 1), EveryoneIncludesAnonymous (DWORD, expected 0), and LimitBlankPasswordUse (DWORD, expected 1). It also reads HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes (REG_MULTI_SZ, expected empty) and NullSessionShares (REG_MULTI_SZ, expected empty). On each value the check evaluates the effective setting after Group Policy merge, not just the local policy hive. The corresponding GPO settings live under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options as Network access: Do not allow anonymous enumeration of SAM accounts, Network access: Do not allow anonymous enumeration of SAM accounts and shares, Network access: Restrict anonymous access to Named Pipes and Shares, Network access: Let Everyone permissions apply to anonymous users, and Network access: Named Pipes that can be accessed anonymously. Guerrilla additionally performs a live behavior test by attempting an anonymous SMB bind (net use \\<dc>\IPC$ /user:"" "") and an SAMR EnumDomainUsers RPC call against each discovered domain controller. If either succeeds, the check fails regardless of the registry state, because runtime behavior is the source of truth.
Por qué importa
Anonymous enumeration converts an unauthenticated network position into a complete inventory of attack targets. Through MS-SAMR a null session returns the full user list (sAMAccountName, RID, lastLogon, badPwdCount, userAccountControl flags), the group membership of Domain Admins, Enterprise Admins, and Schema Admins, and the domain password policy (minimum length, lockout threshold, lockout duration). Through MS-LSAT it resolves arbitrary SIDs to names, which lets an attacker walk the RID space starting at 500 and recover every account in the domain without ever authenticating. Through MS-LSAD it returns the list of trusted domains. With this data the attacker now knows exactly which accounts are non-expiring, which have PASSWD_NOTREQD, which have lockout thresholds permissive enough to spray against, which service accounts likely hold SPNs (Kerberoast candidates), and which trust paths to follow. Every credential attack against the domain becomes faster and quieter. Historically, null session exposure was the single most common finding in pre-engagement reconnaissance for ransomware affiliates because tools like enum4linux, rpcclient, NetExec (formerly CrackMapExec), and impacket lsadump / samrdump operate against it with no credentials. The blast radius is the entire domain user and group population, the password policy, and the trust topology, all without a single Event ID 4625 failed logon.
Ruta de ataque
Step 1: discovery. The attacker identifies domain controllers via DNS SRV records (_ldap._tcp.dc._msdcs.<domain>) or a broadcast of the local subnet for port 445. Step 2: null bind. From any networked host, the attacker establishes an anonymous SMB session: rpcclient -U "" -N <dc>, or net use \\<dc>\IPC$ "" /user:"". No credentials are sent. The connection authenticates as ANONYMOUS LOGON (SID S-1-5-7). Step 3: SAMR enumeration. Using rpcclient commands enumdomusers, enumdomgroups, querydominfo, queryuser <rid>, or NetExec smb <dc> -u "" -p "" --users --groups --pass-pol, the attacker dumps the full user list, group memberships, and password policy. Impacket samrdump.py "" @<dc> produces the same data programmatically. Step 4: RID cycling. Even if SAMR EnumDomainUsers is restricted, the attacker uses MS-LSAT LookupSids to walk the RID space from 500 upward. impacket lookupsid.py anonymous@<dc> 20000 returns every user, group, and computer account with no authentication. Step 5: target selection. The attacker uses the recovered metadata to choose spray targets (accounts with lockout disabled, recent badPwdCount of 0, or PASSWD_NOTREQD), Kerberoast candidates (accounts with servicePrincipalName set, visible through subsequent authenticated LDAP), and AS-REP roast candidates (DONT_REQ_PREAUTH in userAccountControl). Step 6: weaponization. The recovered password policy tells the attacker how aggressively to spray (one attempt per account per lockout window minus one), and the recovered group membership tells them which accounts deliver Tier 0 on success. The attacker now has a credential-attack plan that respects the lockout policy and targets only high-value accounts, all derived from a single unauthenticated reconnaissance pass.
Cómo lo evalúa Guerrilla
Guerrilla detects this condition through three independent paths. First, registry inspection: it reads the four LSA values and the two LanmanServer values on every domain controller via remote registry (StdRegProv WMI) or the Get-ItemProperty cmdlet over PSRemoting where available. Second, GPO inspection: it parses the resultant set of policy via gpresult /scope:computer /v captured against the DC and confirms the effective value of the five Network access security options. Third, behavioral test: it attempts a true anonymous bind by issuing a null-credential SMB session setup to \\<dc>\IPC$ and, on success, issues an MS-SAMR EnumDomainUsers RPC call. The behavioral test is the authoritative signal because Windows applies the registry and policy values during the SamrConnect5 server-side check, and any divergence between the configured policy and the runtime behavior (for example, an out-of-scope GPO, a precedence conflict, or a tattooed registry value) is caught by the live probe. The check correlates results across all DCs in the domain because a single unhardened DC exposes the entire domain to anonymous enumeration.
Valor recomendado
Null session enumeration disabled; RestrictAnonymous and RestrictAnonymousSAM set to prevent anonymous access
Remediación
Configure via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Set 'Network access: Restrict anonymous access to Named Pipes and Shares' = Enabled, 'Network access: Do not allow anonymous enumeration of SAM accounts' = Enabled, 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' = Enabled
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-14
- CIS Benchmark
- 2.3.10.5, 2.3.10.6
- ANSSI
- R30
- CIS AD Benchmark
- 2.4.1
- MITRE ATT&CK
- T1087.002, T1069.002