ADNET-004: Firma del cliente SMB requerida (directiva de dominio)
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La firma SMB del lado del cliente es la mitad del contrato que impide que una estación de trabajo sea inducida a autenticarse ante un servidor SMB malicioso (al estilo de responder). Sin ella, cualquier usuario de la red que sea engañado para resolver un nombre hostil (envenenamiento LLMNR, WPAD, etc.) entrega un hash NTLM que un atacante puede descifrar o retransmitir.
Por qué importa
SMB signing negotiation uses a least-common-denominator rule. If the client does not require signing, an attacker who interposes between the client and a target SMB server can negotiate an unsigned session, then relay the NTLM authentication exchange to a different service (SMB, LDAP, LDAPS, HTTP ADCS Web Enrollment, EWS, MSSQL) and act with the victims privileges on that target. With the client side hardened, the negotiated session must be signed end-to-end, which breaks the most common cross-protocol SMB relay primitives. The blast radius is broad because the attack does not require credentials, an exploit, or any code execution on the victim. Responder, mitm6, Inveigh, or ntlmrelayx running on a flat network segment is enough to: - Capture NTLMv2 challenge responses for offline cracking with hashcat (mode 5600). Service accounts and helpdesk identities with short or pattern passwords fall in minutes. - Relay live to LDAP or LDAPS to add the attackers computer object, write msDS-KeyCredentialLink for Shadow Credentials (ESC14 / Whisker), or enumerate the directory as the victim. - Relay live to an unauthenticated ADCS Web Enrollment endpoint to mint a client authentication certificate for the victim (PetitPotam / ESC8 chain), which then authenticates to a DC via PKINIT and pulls credentials with DCSync. - Relay live to SMB on another host where the victim is a local admin, dropping a payload through ADMIN$ and executing it via services. Microsoft default for this setting is Disabled on member servers and clients, and Disabled in the Default Domain Policy. Only domain controllers require it by default. Without an explicit GPO, every workstation in the environment is one LLMNR/NBT-NS spoof away from giving up a hash.
Ruta de ataque
1. Foothold on the user segment. The attacker only needs an unprivileged shell on any host in the same broadcast / IPv6 link-local scope as targeted users (or a malicious VLAN port, rogue access point, or compromised workstation). 2. Name resolution poisoning. The attacker runs Responder (LLMNR, NBT-NS, mDNS) or Inveigh, and optionally mitm6 to advertise as a rogue IPv6 DNS server. Any client looking up a misspelled or unresolvable hostname (\\fileservr, \\printserver1, WPAD) receives the attackers IP. 3. SMB lure. The client opens an SMB connection to the attacker. Because the client does not require signing, the negotiated session is unsigned. The attacker captures the NTLMv2 challenge response. 4. Choose offline or live. Offline path: feed the NTLMv2 hash to hashcat (mode 5600) and crack to plaintext for credential reuse. Live path: pipe the authentication into impackets ntlmrelayx.py with -t ldaps://dc01 or -t http://ca01/certsrv/certfnsh.asp to relay it without ever seeing the plaintext. 5. Privilege escalation on the relay target. ntlmrelayx --add-computer creates a new computer object and enables RBCD on the victims host; --shadow-credentials adds a KeyCredentialLink and pulls an NT hash via PKINIT; relay to ADCS Web Enrollment yields a smartcard logon certificate the attacker authenticates with for the victim. 6. Tier-0 pivot. If the victim is a domain admin, helpdesk operator, or a server with high privileges, the chain ends at krbtgt extraction via DCSync or direct lateral movement to a domain controller. Mitigations to disrupt the chain: require client SMB signing (this check), require server SMB signing, disable NTLM where possible, enable Extended Protection for Authentication on HTTP endpoints (ADCS Web Enrollment in particular), disable LLMNR and NBT-NS, and add the targeted accounts to Protected Users.
Cómo lo evalúa Guerrilla
Guerrilla executes the check in three stages. 1. GPO parse. The Default Domain Policy is read from SYSVOL (\\\\domain\\SYSVOL\\<domain>\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\Machine\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf). The [Registry Values] section is scanned for MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\RequireSecuritySignature. Expected: 4,1 (REG_DWORD, value 1). Any other linked GPO above the computer scope that overrides this value is also parsed using Get-GPRegistryValue. 2. Effective registry on endpoints. For each reachable domain-joined sample (configurable, defaults to a small set drawn from the Computers container), the check reads HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\RequireSecuritySignature via remote registry. The legacy EnableSecuritySignature value is also read and reported for completeness but does not influence the pass/fail because Microsoft documents it as SMBv1 only and recommends ignoring it. 3. SMB client configuration. Where WinRM is available, Get-SmbClientConfiguration is invoked and the RequireSecuritySignature property is captured. This confirms that no script or MDM channel has set the value outside Group Policy. A pass requires RequireSecuritySignature = 1 in the Default Domain Policy and on every sampled endpoint. The finding object includes the GPO GUID, the registry value observed, and the SmbClientConfiguration property so triage can distinguish a missing GPO from a workstation that is not applying the GPO (group filter, WMI filter, or slow link detection).
Valor recomendado
La directiva Default Domain Policy habilita 'Cliente de red de Microsoft: firmar digitalmente las comunicaciones (siempre)' (RequireSecuritySignature en LanmanWorkstation = 1)
Remediación
Edite la directiva Default Domain Policy: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Opciones de seguridad > 'Cliente de red de Microsoft: firmar digitalmente las comunicaciones (siempre)' = Habilitado. Registro: HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature = 1.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-23
- CIS AD Benchmark
- 6.2.2
- MITRE ATT&CK
- T1557.001