Re: Avoid sending current credentials automatically over the network
- From: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
- Date: Thu, 15 Feb 2007 08:51:59 -0800
Not necessarily. Windows has SSP's for Kerberos, NTLM, and Schannel. While
Windows will try to use the "most secure" (Kerberos) first, there are any
number of circumstances where NT(LM) will be used instead, such as remote
access to a resource where both systems are not members of the same domain
or trusted domains, time synchronization is off by more than five minutes,
or when the remote resource simply requests a particular type of
authentication.
That's why you should specify to only send NTLMv2 and to refuse LM and NTLM
in your local windows security policy.
t
On 2/14/07 9:07 AM, "McCarty, Eric C." <emccarty@xxxxxxxxxxx> spoketh to
all:
"However over the network there is no option to avoid sending current
users creds automatically"
First off, I don't know the type of environment you are working in but
windows uses Kerberos for authentication purposes:
Kerberos differs from username/password authentication methods because
instead of authenticating each user to each network service, it uses
symmetric encryption and a trusted third party - known as the Key
Distribution Center (KDC) - to authenticate users to a suite of network
services. Once a user authenticates to the KDC, it sends a ticket
specific to that session back the user's machine and any kerberized
services look for the ticket on the user's machine rather than asking
the user to authenticate using a password.
As a result you are not really sending uname/pword over the wire.
However I see your point in wanting to avoid using Kerberos, the easiest
way is to specify a guest user when mapping
Net use \\server\share /USER:Guest
You can also disable Kerberos using a registry change :
To disable Kerberos, Microsoft provides a registry hack (the hack is
available from Windows 2000 Service Pack 2 onward). The hack is called
NT4Emulator (REG_DWORD) and should be added to the
HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Netlogon/
Parameters registry key of the Windows 2000 SP2 or later DC and set to
value 1.
Eric
-----Original Message-----
From: Shenk, Jerry A [mailto:jshenk@xxxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, February 13, 2007 3:00 PM
To: Umil; pen-test@xxxxxxxxxxxxxxxxx
Subject: RE: Avoid sending current credentials automatically over the
network
I would recommend blocking those ports (135, 137, 139 and 445) at the
edge router so that at least they aren't sent over the internet. For
some machines, perhaps you want a host firewall to block them from
leaving the box at all.
-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Umil
Sent: Tuesday, February 13, 2007 10:21 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Avoid sending current credentials automatically over the
network
Hi all
When mapping a network share without any credentials parameter or when
clicking in a link for a internal app Windows and IE automatically send
the
current users credentials automatically. Aparently for IE you can
configure
to send anonymous creds (guest account) and then ask for creds.
However over the network there is no option to avoid sending current
users
creds automatically. I tried smb signing but it didn't work.
Does anyone know a solution for it?
Thanks
Uno
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
00000008bOW
------------------------------------------------------------------------
**DISCLAIMER
This e-mail message and any files transmitted with it are intended for
the use of the individual or entity to which they are addressed and may
contain information that is privileged, proprietary and confidential. If
you are not the intended recipient, you may not use, copy or disclose to
anyone the message or any information contained in the message. If you
have received this communication in error, please notify the sender and
delete this e-mail message. The contents do not represent the opinion of
D&E except to the extent that it relates to their official business.
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
00000008bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016000000
08bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
- Prev by Date: RV: nmap -S option
- Next by Date: Re: nmap -S option
- Previous by thread: Re: Avoid sending current credentials automatically over the network
- Next by thread: Log Injection
- Index(es):
Relevant Pages
|
