SMB¶
SMB (Server Message Block) is how Windows shares files and printers. It's also the protocol behind most lateral movement inside a network. Three things to fix: the ancient version 1 is still enabled, old versions and unauthenticated logins are still accepted, and workarounds have been left in place.
SMBv1¶
The 1990s version. It has no protection against relay or tampering and is what WannaCry and NotPetya spread through in 2017. Windows 11 doesn't install it by default; an image can add it back.
Check¶
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select State
Get-SmbServerConfiguration | Select EnableSMB1Protocol
Get-Service mrxsmb10 -ErrorAction SilentlyContinue | Select Status, StartType
Remove¶
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Run optionalfeatures → untick SMB 1.0/CIFS File Sharing Support → OK. Restart when asked.
On Server 2022: Uninstall-WindowsFeature FS-SMB1.
The benchmark also sets it by policy (18.4.1 and 18.4.2 under MS Security Guide): client driver Disable driver, server Disabled.
SMB server policies (this machine sharing files)¶
gpedit.msc → Computer Configuration → Administrative Templates → Network → Lanman Server. These apply when this machine has shares. Set them regardless; they do nothing if nothing is shared.
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.6.7.6 | Mandate the minimum version of SMB | Enabled: 3.1.1 | SMB 3.1.1 has pre-authentication integrity and AES encryption. Older versions are refused. |
| 18.6.7.4 | Enable authentication rate limiter | Enabled | Slows password guessing against shares |
| 18.6.7.7 | Set authentication rate limiter delay (milliseconds) | Enabled: 2000 | Two seconds between failed attempts |
| 18.6.7.5 | Enable remote mailslots | Disabled | Legacy unauthenticated messaging |
| 18.6.7.1 | Audit client does not support encryption | Enabled | Logs clients that would fail if encryption were required |
| 18.6.7.2 | Audit client does not support signing | Enabled | Same, for signing |
| 18.6.7.3 | Audit insecure guest logon | Enabled | Logs guest (unauthenticated) share access attempts |
SMB client policies (this machine connecting to shares)¶
Network → Lanman Workstation:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.6.8.4 | Enable insecure guest logons | Disabled | The client won't connect to a share as guest. A malicious server can't serve up files with no authentication. |
| 18.6.8.6 | Mandate the minimum version of SMB | Enabled: 3.1.1 | |
| 18.6.8.7 | Require Encryption | Enabled | Every share connection from this machine is encrypted |
| 18.6.8.5 | Enable remote mailslots | Disabled | |
| 18.6.8.1 | Audit insecure guest logon | Enabled | |
| 18.6.8.2 | Audit server does not support encryption | Enabled | |
| 18.6.8.3 | Audit server does not support signing | Enabled |
Require Encryption breaks connections to servers that can't encrypt (Windows Server 2012 and earlier, most NAS boxes). On a competition image, apply it unless the README describes an older file server.
Hardened UNC paths¶
Network → Network Provider → Hardened UNC Paths (18.6.14.1): Enabled, with \\*\NETLOGON and \\*\SYSVOL each set to RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1. Group Policy and logon scripts come from those shares; this stops an attacker substituting a fake domain controller.
Signing¶
Both "Digitally sign communications (always)" settings should be Enabled. Covered under Authentication Protocols. Quick check:
Get-SmbServerConfiguration | Select RequireSecuritySignature
Get-SmbClientConfiguration | Select RequireSecuritySignature
Old workarounds¶
In 2020 a bug in SMBv3 compression (CVE-2020-0796) had a temporary workaround: disable compression. It was patched within weeks. An image that still has compression disabled is carrying a workaround that does nothing except signal nobody has maintained it.
Get-SmbServerConfiguration | Select DisableCompression
Set-SmbServerConfiguration -DisableCompression $false -Force
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" /v AllowInsecureGuestAuth /t REG_DWORD /d 0 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation |
AllowInsecureGuestAuth |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation |
RequireEncryption |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation |
MinSmb2Dialect |
REG_DWORD | 785 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanServer |
MinSmb2Dialect |
REG_DWORD | 785 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanServer |
EnableAuthRateLimiter |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanServer |
InvalidAuthenticationDelayTimeInMs |
REG_DWORD | 2000 |
785 is the registry value for SMB 3.1.1 (0x311).
Verify¶
Get-SmbServerConfiguration | Select EnableSMB1Protocol, RequireSecuritySignature, DisableCompression, Smb2DialectMin
Get-SmbClientConfiguration | Select RequireSecuritySignature, EnableInsecureGuestLogons, RequireEncryption
EnableSMB1Protocol : False
RequireSecuritySignature : True
DisableCompression : False
EnableInsecureGuestLogons: False
Try it¶
- Check SMB1 with
Get-SmbServerConfiguration, disable it, and check again. - Turn on signing and connect to a share from another VM. Does it still work?
Build it¶
A smb.ps1 that prints Get-SmbServerConfiguration filtered to the six settings on this page, then sets the ones that are wrong.