4 ms·
Remember, many branch offices have read-only DC's on them, which makes them vulnerable to this bug. It doesn't have to be "important" DC's. Anything with a pass
by jra_samba 11y ago
Remember, many branch offices have read-only DC's on them, which makes them vulnerable to this bug. It doesn't have to be "important" DC's. Anything with a password database will do.
I must confess, on my own internal networks I've moved to trying to avoid any unencrypted traffic on the network. SMB3 helps a lot with this (finally Windows clients will do SMB-level encryption to servers).
- raesene9 11y agoIf you're interested in what pentesters (and presumably their bad guy equivalents) are doing these days on internal pen tests where they start from Local LAN access it's a good idea to look at tools like responder(https://github.com/SpiderLabs/Responder https://github.com/SpiderLabs/Responder), which spoof responses to various queries and can then be used to grab hashes to either to Pass-the-hash attacks or get passed to password cracking tools for recovery of passwords. There's also tools like bettercap (https://www.bettercap.org/docs/ https://www.bettercap.org/docs/) which can already use various tricks to grab creds once a MiTM is sorted..
- jra_samba 11y agoInteresting toolset. Only NTLMv1/v2 mitm attacks possible against a Windows/Samba server though. And the latest patchset should make those impossible if the server were properly configured (i.e. all machines joined to AD, using krb5 auth and SMB3 encrypted file traffic). Of course, I bet few networks are actually set up this way. But correctly configured Windows/Samba networks should be safe from this.