Check SMB signing required

[Acebond]

Check SMB signing required

[itm4n]

Added with commit c323bcc. I finally found a solution to get the configuration without breaking PSv2 compatibility.

You will have to use the option -Audit on the command line to enable this check.

Thanks @rustaska for the tips.

Sample output:

+----------+---------------------------------------------------+
| CATEGORY | TA0008 - Lateral Movement                         |
| NAME     | SMB configuration                                 |
+----------+---------------------------------------------------+
| Check whether SMBv1 is enabled (server), and whether signing |
| is required (server and client).                             |
+--------------------------------------------------------------+
[*] Status: Vulnerable - Low


Role        : Server
Parameter   : EnableSMB1Protocol
Value       : False
Vulnerable  : False
Description : SMBv1 is disabled.

Role        : Server
Parameter   : RequireSecuritySignature
Value       : False
Vulnerable  : True
Description : SMB signing is not required.

Role        : Client
Parameter   : RequireSecuritySignature
Value       : False
Vulnerable  : True
Description : SMB signing is not required.

[itm4n]

Hey!

Well, I have mixed feelings about this. On the one hand, I totally get your point as this is something I would report during a pentest. But on the other hand, I would like to avoid turning PrivescCheck into a "configuration audit tool" as far as possible. That being said, SMB signing enforcement is a big topic, that might be worth considering on its own.

I'll have to think about it. :)

[rustaska]

@Acebond Your suggested method will currently work but not in the future. Microsoft decided to require SMB signing by default in future releases, which means the registry value "RequireSecuritySignature" does not necessarily have to be around to have SMB signing enabled.

You can read it in this blog post: https://techcommunity.microsoft.com/t5/storage-at-microsoft/smb-signing-required-by-default-in-windows-insider/ba-p/3831704

According to this, a future proof method will be using the Get-SmbServerConfiguration and Get-SmbClientConfiguration Cmdlet or the CIM classes MSFT_SmbClientConfiguration and MSFT_SmbServerConfiguration.

[itm4n]

Commit 099b4d3 prepares the ground for handling "configuration audit" checks. It adds a new check type - Audit - and the corresponding command line flag -Audit. This will allow me to add an SMB signing check in this category.

[Acebond]

Legend. I just checked and it works for me. I'm going to close the issue.