ADNET-006: Configuración de NetBIOS sobre TCP/IP revisada
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- Medium
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
NetBIOS-NS es la segunda vía de los ataques de envenenamiento de resolución de nombres después de LLMNR. Deshabilitarlo a nivel de DHCP/interfaz requiere un restablecimiento de la configuración de red que la GPO no puede expresar por completo; sin embargo, el valor NetbiosOptions de Tcpip\Parameters\Interfaces se puede establecer mediante la opción de ámbito DHCP 1 o directamente en el registro. Esta comprobación informa si ALGÚN artefacto de directiva de todo el dominio lo aborda, para que el auditor sepa si debe investigar en la capa de DHCP o de imagen.
Por qué importa
NetBIOS-NS poisoning is the workhorse of internal network compromise. In Mandiant M-Trends, SpecterOps engagement retrospectives, and TrustedSec red-team reports, Responder against NBT-NS is the single most common technique for harvesting credentials on a flat corporate VLAN with no prior foothold beyond an Ethernet jack or a Wi-Fi PSK. The protocol design is the vulnerability: NBT-NS uses UDP 137 broadcast for name resolution with no authentication of responses, so any host on the broadcast domain that answers first wins the race. Once an attacker becomes the destination of a misdirected SMB connection (typically a mistyped server name, a stale DFS reference, a roaming profile path, a printer queue, or a Web Proxy Auto-Discovery query), the victim performs NTLM authentication directly to the attacker, who captures the Net-NTLMv2 challenge response. That hash is then either cracked offline with hashcat (-m 5600, viable for any password under roughly 12 characters of mixed entropy) or relayed live to a target that does not enforce SMB signing (ntlmrelayx -t smb://fileserver), to an LDAP service without channel binding (ntlmrelayx -t ldap://dc01 -ip <attacker>), or to an Exchange or ADCS HTTP endpoint (PetitPotam-style coercion to CVE-2021-36942 ESC8 relay), yielding a foothold as the relayed user. Disabling LLMNR alone (ADNET-005) is insufficient because Windows falls through to NBT-NS as the next leg of name resolution. Both legs must be closed for the kill chain to be broken at the protocol level. Leaving NetBIOS enabled domain-wide turns every poorly-segmented broadcast domain into a credential-harvesting opportunity for any adversary who gains an L2 presence, which in modern environments includes BYOD, IoT, contractor laptops, and physically accessible network jacks.
Ruta de ataque
Step 1: L2 presence. The attacker has any device on the same broadcast domain as Windows clients. This is trivial in flat office networks, in conference rooms, on guest VLANs that share subnets with corporate, on Wi-Fi where client isolation is not enforced, on a compromised printer, or on a Raspberry Pi dropped under a desk. Step 2: Start the poisoner. responder -I eth0 -wrf (Responder), or Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -LLMNR Y (Inveigh PowerShell), or ntlmrelayx.py -tf targets.txt -smb2support combined with mitm6 or Responder for the poisoning layer. The tool answers NBT-NS queries (UDP 137 broadcast) and LLMNR queries (UDP 5355 multicast) for any name not already cached by the victim. Step 3: Wait for a name miss. Windows clients constantly try to resolve names that do not exist in DNS: WPAD (Web Proxy Auto-Discovery), mistyped server names, decommissioned file shares still referenced in scheduled tasks, printer queues, roaming profiles, group policy preferences targeting old hostnames, mapped drives in login scripts. Each miss triggers NBT-NS broadcast within seconds of a user logging in. On a 500-seat floor, Responder captures dozens of hashes per hour with no user interaction. Step 4a (crack). The captured Net-NTLMv2 hash is fed to hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule. Service-account passwords, helpdesk accounts, and any user with a password under 12 characters of mixed entropy fall in minutes to hours. Step 4b (relay). For accounts whose hash will not crack, the attacker relays live: ntlmrelayx.py -t smb://fileserver01 -smb2support -socks captures an authenticated SMB session as the victim against any target server that does not enforce SMB signing (ADNET-002). Relaying to LDAP without channel binding (ADNET-003) yields the ability to add a new computer account and write msDS-AllowedToActOnBehalfOfOtherIdentity for RBCD takeover. Relaying to ADCS web enrollment (ESC8, CVE-2021-36942) yields a certificate as the victim, which is then used to authenticate as any user including Domain Admins. Step 5: Pivot. The cracked or relayed credential is used for lateral movement: psexec, wmiexec, PowerShell Remoting, RDP. Within a single shift the attacker typically reaches a service account with administrative rights on a tier-1 server, from which Kerberoasting (ADKERB-001) or DCSync via a delegated ACL (ADACL-005) yields Tier 0. Step 6: Persistence and re-poisoning. The attacker leaves the poisoner running for a multi-day capture window, optionally with -Analyze mode that records hashes without responding (to avoid setting off Microsoft Defender for Identity alerts on Responder activity), and reactivates response mode during business hours when capture density is highest.
Cómo lo evalúa Guerrilla
Guerrilla performs three discovery passes. First (GPP enumeration): for each GPO returned by Get-GPO -All, the check downloads \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Registry\Registry.xml and parses each <Registry> element looking for properties where key matches "SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\\Tcpip_" and name equals "NetbiosOptions" with type REG_DWORD and value 2. It records the GPO display name, GUID, link scope (which OUs the GPO is linked to), and security filtering so the operator can confirm the policy actually reaches workstations rather than only one OU. Second (DHCP option scan): when the check is run against, or pointed at, a Microsoft DHCP server, it invokes Get-DhcpServerv4OptionValue -ScopeId <each scope> and inspects OptionId 1 in vendor class "Microsoft Windows 2000 Options" for the value 0x2 (disable NetBIOS over TCP/IP); it does the same for IPv4 server-level defaults via Get-DhcpServerv4OptionValue -All. Third (imaging baseline): the check inspects well-known paths for MDT (\\<server>\DeploymentShare$\Control\CustomSettings.ini for a NetbiosOptions=2 line) and SCCM (the Configuration Manager site provider for task sequence steps and configuration baselines that target the NetBT registry value). The check passes only if at least one of the three artifacts is present and the artifact targets the workstation OUs (not just servers, not just domain controllers). When no artifact is found, the check returns a Medium finding with the recommendation to investigate at the DHCP or imaging layer rather than attempting to push a per-interface registry value through standard GPO security settings (which the GPO security extension cannot express directly because the interface GUIDs are per-machine).
Valor recomendado
Existe un método de todo el dominio para deshabilitar NetBIOS sobre TCP/IP en las estaciones de trabajo (opción DHCP 1 = 0x2, preferencia de directiva de grupo o línea base de imagen)
Remediación
Deshabilite NetBIOS sobre TCP/IP en toda la flota. Opciones: (1) Establezca la opción de ámbito DHCP Microsoft Disable Netbios Option (opción 1) en 0x2; (2) Preferencias de directiva de grupo > Configuración de Windows > Registro para insertar NetbiosOptions = 2 en cada clave Tcpip_<Interface>; (3) Incorpórelo a la línea base de imagen de la estación de trabajo. Este parámetro es específico de la interfaz y no se puede abordar directamente mediante la configuración de seguridad estándar de GPO.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
| informational | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.2
- MITRE ATT&CK
- T1557.001