Check SMB signing required

[Acebond]

PrivescCheck covers the majority of the host checks I'd perform except SMB signing, which is often useful to know, especially as there are a bunch of different and whacky (like https://github.com/nccgroup/Change-Lockscreen) ways to coerce a SYSTEM/user account to authenticate to a capture/relay server.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing

I've written a reference implementation below. I reckon it should probably be in the -Extended category?

function Get-SMBSigningStatus {
# NOTE: The EnableSecuritySignature registry setting for SMB2+ client and SMB2+ server is ignored.
# Therefore, this setting does nothing unless you're using SMB1. So we only care about RequireSecuritySignature.
# https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing

    $SmbClientSettingsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters"
    $SmbServerSettingsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

    # Check if the registry value exists
    if (Test-Path $SmbClientSettingsPath) {

        $value = Get-ItemPropertyValue -Path $SmbClientSettingsPath -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue
        $status = if ($value -eq 1) { "Required" } else { "NOT Required" }
        Write-Output "SMB Client signing is $status."

    } else {

        Write-Output "SMB Client signing settings not found"
    }


    # Check if the registry value exists
    if (Test-Path $SmbServerSettingsPath) {

        $value = Get-ItemPropertyValue -Path $SmbServerSettingsPath -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue
        $status = if ($value -eq 1) { "Required" } else { "NOT Required" }
        Write-Output "SMB Server signing is $status."

    } else {

        Write-Output "SMB Server signing settings not found"
    }

}

Get-SMBSigningStatus

[itm4n]

Hey!

Well, I have mixed feelings about this. On the one hand, I totally get your point as this is something I would report during a pentest. But on the other hand, I would like to avoid turning PrivescCheck into a "configuration audit tool" as far as possible. That being said, SMB signing enforcement is a big topic, that might be worth considering on its own.

I'll have to think about it. :)

[rustaska]

@Acebond Your suggested method will currently work but not in the future. Microsoft decided to require SMB signing by default in future releases, which means the registry value "RequireSecuritySignature" does not necessarily have to be around to have SMB signing enabled.

You can read it in this blog post: https://techcommunity.microsoft.com/t5/storage-at-microsoft/smb-signing-required-by-default-in-windows-insider/ba-p/3831704

According to this, a future proof method will be using the Get-SmbServerConfiguration and Get-SmbClientConfiguration Cmdlet or the CIM classes MSFT_SmbClientConfiguration and MSFT_SmbServerConfiguration.

[itm4n]

Commit 099b4d3 prepares the ground for handling "configuration audit" checks. It adds a new check type - Audit - and the corresponding command line flag -Audit. This will allow me to add an SMB signing check in this category.