Windows SMB Reflection Flaw Can Yield SYSTEM Access; SMB Signing Mitigates Attack
· 26:16 · Watch on YouTube ↗
Summary
Wilfried Bécard describes NTLM and Kerberos reflection against Windows SMB that can yield SYSTEM-level access when SMB signing is not required. He says Microsoft’s June patch blocks the coercion path and recommends enabling SMB signing.
Key points
- The demonstrated attack requires an authenticated user and an SMB target that does not require SMB signing.
- The researchers describe registering a crafted DNS record and coercing a machine to authenticate to it; manipulated target information causes the connection to resolve back to the target host.
- The talk explains how local NTLM and Kerberos authentication behavior enables reflection and lets the SMB service use the client’s token.
- In the demo, the reflected authentication results in a shell running as NT AUTHORITY\SYSTEM on the workstation.
- Microsoft described the issue as a Windows SMB client elevation-of-privilege vulnerability; the researchers argue the demonstrated impact can include remote code execution.
- The speaker says Microsoft’s June patch adds a client-side check that blocks the crafted target-information coercion path.
- The researchers recommend enabling SMB signing, which they say blocks exploitation of this attack on the SMB service.
Article Details
- Topics
- [00:29] Windows SMB client vulnerability, attack prerequisites, and reported impact
- [02:25] Authentication coercion, relay, reflection, and Kerberos concepts
- [08:14] Accidental discovery of NTLM reflection using a crafted DNS record
- [10:41] Root cause: local NTLM authentication and token use
- [20:02] Kerberos reflection mechanism and privileged authentication
- [23:42] Microsoft’s patch analysis and the SMB client check
- [25:15] SMB signing as a mitigation
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe speaker describes exploiting the SMB vulnerability to obtain elevated SYSTEM-level access.T1134.001 · Token Impersonation/TheftThe talk explains that the SMB service uses the reflected client token to impersonate the client.T1187 · Forced AuthenticationThe talk describes coercing a target machine to authenticate to an attacker-controlled server.T1557 · Adversary-in-the-MiddleThe demonstrated attack relays authentication back to the same machine through NTLM or Kerberos reflection.
People
GumWilfried Bécard’s colleague and collaborator on the research; the speaker says Gum could not attend the talk.James ForoResearcher credited in the talk with discovering that credential target information could be appended to the SPN and discarded during authentication.Wilfried BécardPresenter and researcher who describes the Windows SMB reflection research and its technical analysis.