# SMB: Sharing more than your files...

Jonathan Brossard

► To cite this version:

Jonathan Brossard. SMB: Sharing more than your files.... Blackhat USA, Blackhat, Jul 2015, Las Vegas, United States. hal-04606162

HAL Id: hal-04606162

https://hal.science/hal-04606162

Submitted on 9 Jun 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# SMB: Sharing more than your files...

Jonathan Brossard

► To cite this version:

Jonathan Brossard. SMB: Sharing more than your files.... Blackhat USA, Blackhat, Jul 2015, Las Vegas, United States. hal-04606162

HAL Id: hal-04606162

https://hal.science/hal-04606162v1

Submitted on 9 Jun 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
SMB : Sharing more than your files...

Xiaoran Wang, Sergey Gorbaty, Hormazd Billimoria, Angelo Prado, Anton Rager, Jonathan Brossard

“Give it to me baby.” – Rick James

**Abstract.** In this white paper, we present a new attack vector against the Windows Single Sign On (SSO) feature of Microsoft Windows, leveraging the venerable Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, including Windows 10¹. While attacks involving SMB have long time been common in local networks, this new attack allows complete user compromise from the Internet. By leveraging a series of bugs and malfunctions, we shall see how remote credentials theft or user impersonation can be performed with minimal user interaction, extremely reliably, and from the Internet. This is in particular believed to be the first attack against Windows 10 and its web browser Spartan. Finally, we will contemplate a strategy to contain the problem at perimeter level and why it is doomed to largely fail, as well as suggest additional hardening to remediate this vulnerability more consistently at host level.

**Keywords:** SMB, corporate file sharing, remote mass credentials theft, user impersonation.

<footnote n="1">¹ The final release of Windows 10 has not yet been made public at the time of writing. Experiment based on Win10 Preview.</footnote>
SMB : Sharing more than your files...

Xiaoran Wang, Sergey Gorbaty, Hormazd Billimoria, Angelo Prado, Anton Rager, Jonathan Brossard

“Give it to me baby.” – Rick James

**Abstract.** In this white paper, we present a new attack vector against the Windows Single Sign On (SSO) feature of Microsoft Windows, leveraging the venerable Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, including Windows 10¹. While attacks involving SMB have long time been common in local networks, this new attack allows complete user compromise from the Internet. By leveraging a series of bugs and malfunctions, we shall see how remote credentials theft or user impersonation can be performed with minimal user interaction, extremely reliably, and from the Internet. This is in particular believed to be the first attack against Windows 10 and its web browser Spartan. Finally, we will contemplate a strategy to contain the problem at perimeter level and why it is doomed to largely fail, as well as suggest additional hardening to remediate this vulnerability more consistently at host level.

**Keywords:** SMB, corporate file sharing, remote mass credentials theft, user impersonation.

<footnote n="1">¹ The final release of Windows 10 has not yet been made public at the time of writing. Experiment based on Win10 Preview.</footnote>
# Table of Contents

<table><tr><td>SMB: Sharing more than your files</td><td>1</td></tr><tr><td colspan="2">Xiaoran Wang, Sergey Gorbaty, Hormazd Billimoria, Angelo Prado, Anton Rager, Jonathan Brossard</td></tr><tr><td>1 Introduction</td><td>2</td></tr><tr><td>1.1 History</td><td>3</td></tr><tr><td>1.2 Authentication overview</td><td>3</td></tr><tr><td>1.3 Previous work</td><td>3</td></tr><tr><td>2 French Kiss attack</td><td>4</td></tr><tr><td>2.1 Lab setup</td><td>4</td></tr><tr><td>2.2 Default Internet Explorer User Authentication settings</td><td>4</td></tr><tr><td>2.3 A naive approach to SMB</td><td>5</td></tr><tr><td>2.4 Empirical Results</td><td>5</td></tr><tr><td>2.5 Interpretation: Epic Single Sign On design failure</td><td>6</td></tr><tr><td>2.6 Cracking the hash</td><td>6</td></tr><tr><td>2.7 Hardened configurations: SMB Packet Signing</td><td>6</td></tr><tr><td>3 Menage a Trois</td><td>7</td></tr><tr><td>4 Other triggers</td><td>8</td></tr><tr><td>5 Mitigation</td><td>8</td></tr><tr><td>6 Conclusion</td><td>9</td></tr><tr><td>7 Acknowledgements</td><td>9</td></tr></table>

## 1 Introduction

SMB is arguably one of the most audited protocols as far as internal enterprise networks are concerned: it is part of virtually every corporation's internal network penetration test plan. Because it was first designed for NetBIOS, a protocol non routable over the Internet, there is a widespread assumption that attacks originating from the Internet are however not practical. This white paper will first aim at showing that it is in fact possible to carry out very similar attacks remotely from the Internet. This will naturally lead to a very reliable exploit functional on all versions of Internet Explorer on all versions of Windows. We will then envisage further variations of this attack, extending exploitation scenarios to clients beyond web browsers, and adapting it to remain effective against hardened network configurations.

In this first chapter, we will with no further due present a brief history of the SMB protocol, before describing its authentication mechanism and summarizing notable research having impacted SMB over the course of three decades.
# Table of Contents

<table><tr><td>SMB : Sharing more than your files</td><td>1</td></tr><tr><td colspan="2">Xiaoran Wang, Sergey Gorbaty, Hormazd Billimoria, Angelo Prado, Anton Rager, Jonathan Brossard</td></tr><tr><td>1 Introduction</td><td>2</td></tr><tr><td>1.1 History</td><td>3</td></tr><tr><td>1.2 Authentication overview</td><td>3</td></tr><tr><td>1.3 Previous work</td><td>3</td></tr><tr><td>2 French Kiss attack</td><td>4</td></tr><tr><td>2.1 Lab setup</td><td>4</td></tr><tr><td>2.2 Default Internet Explorer User Authentication settings</td><td>4</td></tr><tr><td>2.3 A naive approach to SMB</td><td>5</td></tr><tr><td>2.4 Empirical Results</td><td>5</td></tr><tr><td>2.5 Interpretation : Epic Single Sign On design failure</td><td>6</td></tr><tr><td>2.6 Cracking the hash</td><td>6</td></tr><tr><td>2.7 Hardened configurations : SMB Packet Signing</td><td>6</td></tr><tr><td>3 Menage a Trois</td><td>7</td></tr><tr><td>4 Other triggers</td><td>8</td></tr><tr><td>5 Mitigation</td><td>8</td></tr><tr><td>6 Conclusion</td><td>9</td></tr><tr><td>7 Acknowledgements</td><td>9</td></tr></table>

## 1 Introduction

SMB is arguably one of the most audited protocols as far as internal enterprise networks are concerned : it is part of virtually every corporation's internal network penetration test plan. Because it was first designed for NetBIOS, a protocol non routable over the Internet, there is a widespread assumption that attacks originating from the Internet are however not practical. This white paper will first aim at showing that it is in fact possible to carry out very similar attacks remotely from the Internet. This will naturally lead to a very reliable exploit functional on all versions of Internet Explorer on all versions of Windows. We will then envisage further variations of this attack, extending exploitation scenarios to clients beyond web browsers, and adapting it to remain effective against hardened network configurations.

In this first chapter, we will with no further due present a brief history of the SMB protocol, before describing its authentication mechanism and summarizing notable research having impacted SMB over the course of three decades.
## 1.1 History

The Server Message Block (SMB) protocol is a network protocol allowing files and printers sharing over NetBIOS, TCP/IP and IPX/SPX. Initially designed by IBM in 1984, it is nowadays extremely common in corporate networks. The most common implementations are the predominant Microsoft SMB stack shipped with Windows, as well as the Open source Samba implementations (on Unix like computers).

In the rest of this paper, we will focus solely on the Microsoft implementation of the protocol - featuring many Microsoft specific and complex<fnref n="2" /> extensions -, which is enabled by default on every version of Windows since at least Windows NT 4.0. If previous versions used NetBIOS predominantly, since Windows 2000 SMB is available by default over UDP on ports 137/138, TCP ports 137/139 (called "NetBIOS over TCP") and TCP port 445 (called "Direct SMB").

The protocol has gone through several versions, SMB 2.0 being first shipped with Vista (2006), version 2.1 with Win7, SMB version 3.0 with Win8 or 2012 server, and SMB version 3.2 with Windows 8.1 and Windows Server 2012 R2.

Initially a closed source protocol, the specifications of SMB have been famously reversed engineered by the Samba Project[1] team. Microsoft has since released its official own specifications for CIFS[2] and SMB[3][4] to the public.

## 1.2 Authentication overview

SMB is a cross platform protocol supported on both Unix and Windows machines. As of SMB v3.0 the protocol allows file sharing within a Windows Domain. To allow file sharing in a Windows Domain, SMB requires an authentication algorithm, which initially were LM and NTLM hash based authentications. Those hash functions however showed severe weaknesses[5], and have been deprecated in favor of NTLM v2³. Our paper however focuses on SMB and NTLMv2 authentication. NTLMv2 is a challenge response based authentication protocol which contains both a client and server side nonce. Details of NTLMv2 are described in later sections of this paper.

## 1.3 Previous work

The funding research in regards to SMB security is the original research from the Cult of the Dead Cow[5] presented in 2001 by Sir Dystic at the Lantacon conference. The vulnerability later received the CVE number CVE-2008-4037. While this research focused only on the NetBIOS protocol non routable over the internet, it featured a full working exploit against the authentication mechanism of SMB by relaying its challenge/response mechanism to a third party server.

Since then, variations of this attack have been published to perform SMB relays to UDP and TCP, and most notably to https gateways accepting NTLM based authentication. The Metasploit[6] framework now features a comprehensive list of SMB relays to such protocols.

An interesting extension is the ability to perform outgoing SMB connections thanks to other network services, such as SQL Servers[7]. Such attacks open the door to new attack surfaces and attack scenarios.

Finally, SMB, like any complex network protocol has been vulnerable to its share of bugs and overflows. Since SMB parsing is performed largely in kernel land, it is worth noticing that remote SYSTEM compromise has been previously achieved[8][9][10], leading to a CVSS maximal score of 10.

<footnote n="2">² The SMB v2 and v3 specification is well over 400 pages and the CIFS specification is over 700 pages.</footnote>

<footnote n="3">³ as of Windows XP.</footnote>
## 1.1 History

The Server Message Block (SMB) protocol is a network protocol allowing files and printers sharing over NetBIOS, TCP/IP and IPX/SPX. Initially designed by IBM in 1984, it is nowadays extremely common in corporate networks. The most common implementations are the predominant Microsoft SMB stack shipped with Windows, as well as the Open source Samba implementations (on Unix like computers).

In the rest of this paper, we will focus solely on the Microsoft implementation of the protocol - featuring many Microsoft specific and complex<fnref n="2" /> extensions -, which is enabled by default on every version of Windows since at least Windows NT 4.0. If previous versions used NetBIOS predominantly, since Windows 2000 SMB is available by default over UDP on ports 137/138, TCP ports 137/139 (called "NetBIOS over TCP") and TCP port 445 (called "Direct SMB").

The protocol has gone through several versions, SMB 2.0 being first shipped with Vista (2006), version 2.1 with Win7, SMB version 3.0 with Win8 or 2012 server, and SMB version 3.2 with Windows 8.1 and Windows Server 2012 R2.

Initially a closed source protocol, the specifications of SMB have been famously reversed engineered by the Samba Project[1] team. Microsoft has since released its official own specifications for CIFS[2] and SMB[3][4] to the public.

## 1.2 Authentication overview

SMB is a cross platform protocol supported on both Unix and Windows machines. As of SMB v3.0 the protocol allows file sharing within a Windows Domain. To allow file sharing in a Windows Domain, SMB requires an authentication algorithm, which initially were LM and NTLM hash based authentications. Those hash functions however showed severe weaknesses[5], and have been deprecated in favor of NTLM v2³. Our paper however focuses on SMB and NTLMv2 authentication. NTLMv2 is a challenge response based authentication protocol which contains both a client and server side nonce. Details of NTLMv2 are described in later sections of this paper.

## 1.3 Previous work

The funding research in regards to SMB security is the original research from the Cult of the Dead Cow[5] presented in 2001 by Sir Dystic at the Lantacon conference. The vulnerability later received the CVE number CVE-2008-4037. While this research focused only on the NetBIOS protocol non routable over the internet, it featured a full working exploit against the authentication mechanism of SMB by relaying its challenge/response mechanism to a third party server.

Since then, variations of this attack have been published to perform SMB relays to UDP and TCP, and most notably to https gateways accepting NTLM based authentication. The Metasploit[6] framework now features a comprehensive list of SMB relays to such protocols.

An interesting extension is the ability to perform outgoing SMB connections thanks to other network services, such as SQL Servers[7]. Such attacks open the door to new attack surfaces and attack scenarios.

Finally, SMB, like any complex network protocol has been vulnerable to its share of bugs and overflows. Since SMB parsing is performed largely in kernel land, it is worth noticing that remote SYSTEM compromise has been previously achieved[8][9][10], leading to a CVSS maximal score of 10.

<footnote n="2">² The SMB v2 and v3 specification is well over 400 pages and the CIFS specification is over 700 pages.</footnote>

<footnote n="3">³ as of Windows XP.</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1. Default Internet Explorer/Spartan User Authentication settings</figcaption></figure>

## 2 French Kiss attack

In this chapter, we will describe the "French Kiss attack", an extension of existing LAN attacks on SMB, however working from the Internet. We will introduce it via the naive study of an SMB connection over the Internet. We shall start by describing the setup used for a quick experiment involving loading an image over SMB from a remote SMB share located on a Public IP on the web. We will then follow up with the results of this empirical study and infer a few conclusions in regards to the authentication mechanisms of SMB in such circumstances.

### 2.1 Lab setup

To conduct the experiment described in this chapter, we used a few instances of Windows and Linux, all fully up to date, running on Amazon's EC2.

The target machines are represented by two instances of Windows. The first instance running Windows 7 amd64, the second one featuring the latest Windows 10 Preview amd64. Those two machines use Internet Explorer 10 and Spartan respectively as default web browsers.

An additional server running Linux was provisioned on EC2, and a Samba server installed on it.

### 2.2 Default Internet Explorer User Authentication settings

The User Authentication settings of the two web browsers were left to their default configuration, represented in *figure 1*. As per the Microsoft documentation, they instruct the web browser to attempt to log automatically to network shares on the local network<fnref n="4" />, but to prompt for credentials when attempting to authenticate against remote file sharing servers located on the Internet.

<footnote n="4">⁴ In an attempt to implement Single Sign On across a local network.</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1. Default Internet Explorer/Spartan User Authentication settings</figcaption></figure>

## 2 French Kiss attack

In this chapter, we will describe the "French Kiss attack", an extension of existing LAN attacks on SMB, however working from the Internet. We will introduce it via the naive study of an SMB connection over the Internet. We shall start by describing the setup used for a quick experiment involving loading an image over SMB from a remote SMB share located on a Public IP on the web. We will then follow up with the results of this empirical study and infer a few conclusions in regards to the authentication mechanisms of SMB in such circumstances.

### 2.1 Lab setup

To conduct the experiment described in this chapter, we used a few instances of Windows and Linux, all fully up to date, running on Amazon's EC2.

The target machines are represented by two instances of Windows. The first instance running Windows 7 amd64, the second one featuring the latest Windows 10 Preview amd64. Those two machines use Internet Explorer 10 and Spartan respectively as default web browsers.

An additional server running Linux was provisioned on EC2, and a Samba server installed on it.

### 2.2 Default Internet Explorer User Authentication settings

The User Authentication settings of the two web browsers were left to their default configuration, represented in *figure 1*. As per the Microsoft documentation, they instruct the web browser to attempt to log automatically to network shares on the local network<fnref n="4" />, but to prompt for credentials when attempting to authenticate against remote file sharing servers located on the Internet.

<footnote n="4">⁴ In an attempt to implement Single Sign On across a local network.</footnote>
<figure><img src="image_3.png" /><figcaption>Fig. 2. html to SMB trivial trigger</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 3. SMB Packet capture</figcaption></figure>

## 2.3 A naive approach to SMB

Assuming no particular knowledge of SMB, we will simply load an html page (represented in figure 2) using Internet Explorer. This page includes an image tag, whose URI starts with the file:// prefix<fnref n="5" />, indicating inclusion from a remote file share. We shall in addition start a packet sniffer in the background to monitor all network activity on the target host machine.

**Note**: Given the settings explicit in figure 1, and given that the IP on the remote image tag in figure 2 is not part of any particular network other than the greater Internet, we of course expect this connection to *fail*.

## 2.4 Empirical Results

When attempting to load the sample html file within Internet Explorer, the image hosted on the remote Linux Samba share is not displayed, and Windows doesn't ask for user credentials either. At first sight, it seems like IE didn't even try to connect to the remote SMB share.

The packet sniffer however, indicates otherwise : if the image isn't rendered by the web browser, it is very much being downloaded over SMB. Silently. From a remote share on the Internet. By sending Windows logon credentials.

The data captured by the packet sniffer is detailed in figure 3. As it would on a local network, Internet Explorer is sending the username of the user in plain text, and a NTLMv2 hash of its Windows logon passphrase.

<footnote n="5">⁵ The alternate Microsoft \\prefix can here be used interchangeably.</footnote>
<figure><img src="image_3.png" /><figcaption>Fig. 2. html to SMB trivial trigger</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 3. SMB Packet capture</figcaption></figure>

## 2.3 A naive approach to SMB

Assuming no particular knowledge of SMB, we will simply load an html page (represented in figure 2) using Internet Explorer. This page includes an image tag, whose URI starts with the file:// prefix<fnref n="5" />, indicating inclusion from a remote file share. We shall in addition start a packet sniffer in the background to monitor all network activity on the target host machine.

**Note**: Given the settings explicited in figure 1, and given that the IP on the remote image tag in figure 2 is not part of any particular network other than the greater Internet, we of course expect this connection to *fail*.

## 2.4 Empirical Results

When attempting to load the sample html file within Internet Explorer, the image hosted on the remote Linux Samba share is not displayed, and Windows doesn't ask for user credentials either. At first sight, it seems like IE didn't even try to connect to the remote SMB share.

The packet sniffer however, indicates otherwise : if the image isn't rendered by the web browser, it is very much being downloaded over SMB. Silently. From a remote share on the Internet. By sending Windows logon credentials.

The data captured by the packet sniffer is detailed in figure 3. As it would on a local network, Internet Explorer is sending the username of the user in plain text, and a NTLMv2 hash of its Windows logon passphrase.

<footnote n="5">⁵ The alternate Microsoft \\prefix can here be used interchangeably.</footnote>
<figure><img src="image_5.png" /><figcaption>Fig. 4. Hash cracking hardware</figcaption></figure>

## 2.5 Interpretation: Epic Single Sign On design failure

While the trigger of this vulnerability is indeed trivial, one shall not be mistaken: this is a very serious vulnerability in the Single Sign On implementation of Windows. As a matter of fact, not only the French Kiss attack requires no special exploit code apart from a couple lines of html, but this failure in SSO results in Internet Explorer silently sending over the Internet Windows logon credentials, and even Active Directory network credentials - if the machine is connected to a Domain, which is typically the case for the vast majority of Corporate users. To the best of our knowledge, this trigger works on all versions of Internet Explorer to date, on all versions of Windows.

**Note:** Given the amount of penetration testing routinely performed on SMB and the number of complex tools dedicated to dumping Windows SSO credentials or relay SMB connections, it seems almost incredible that such a vulnerability could remain unreported to the vendor for over three decades. From our interaction with the Microsoft Security Response Team, such seem however to be the case!

## 2.6 Cracking the hash

The French Kiss attack allows an attacker to capture Windows SSO usernames and NTLMv2 hashes of passwords. In order to impersonate the legitimate user, a first avenue is to attempt to crack the afore mentioned captured hashes. A review of the state of the art on cracking NTLMv2 hashes[11] is beyond the scope of this whitepaper. In an attempt to however provide orders of magnitude, the authors engaged in the GPU-assisted cracking (see figure 4) of a captured hash. Our setup is comprised of a desktop machine equipped with 5 GPU cards, capable of testing 2.4 billion hashes a second. For a character set of [a-zA-Z!@#$%&], the maximum cracking time is of 2 days and 5 hours given a password length of 8 characters. The screenshot in figure 5 shows that we cracked the password Vn4@2Bpt using Hashcat under those time constraints.

## 2.7 Hardened configurations : SMB Packet Signing

Since Windows NT4.0 with Service Pack 3 and Windows 2000, SMB supports packet signing of every packet to ensure their content hasn't been tempered in transit. This option is disabled by default for
<figure><img src="image_5.png" /><figcaption>Fig. 4. Hash cracking hardware</figcaption></figure>

## 2.5 Interpretation : Epic Single Sign On design failure

While the trigger of this vulnerability is indeed trivial, one shall not be mistaken: this is a very serious vulnerability in the Single Sign On implementation of Windows. As a matter of fact, not only the French Kiss attack requires no special exploit code apart from a couple lines of html, but this failure in SSO results in Internet Explorer silently sending over the Internet Windows logon credentials, and even Active Directory network credentials - if the machine is connected to a Domain, which is typically the case for the vast majority of Corporate users. To the best of our knowledge, this trigger works on all versions of Internet Explorer to date, on all versions of Windows.

Note: Given the amount of penetration testing routinely performed on SMB and the number of complex tools dedicated to dumping Windows SSO credentials or relay SMB connections, it seems almost incredible that such a vulnerability could remain unreported to the vendor for over three decades. From our interaction with the Microsoft Security Response Team, such seem however to be the case!

## 2.6 Cracking the hash

The French Kiss attack allows an attacker to capture Windows SSO usernames and NTLMv2 hashes of passwords. In order to impersonate the legitimate user, a first avenue is to attempt to crack the afore mentioned captured hashes. A review of the state of the art on cracking NTLMv2 hashes[11] is beyond the scope of this whitepaper. In an attempt to however provide orders of magnitude, the authors engaged in the GPU-assisted cracking (see figure 4) of a captured hash. Our setup is comprised of a desktop machine equipped with 5 GPU cards, capable of testing 2.4 billion hashes a second. For a character set of [a-zA-Z!@#$%&], the maximum cracking time is of 2 days and 5 hours given a password length of 8 characters. The screenshot in figure 5 shows that we cracked the password Vn4@2Bpt using Hashcat under those time constraints.

## 2.7 Hardened configurations : SMB Packet Signing

Since Windows NT4.0 with Service Pack 3 and Windows 2000, SMB supports packet signing of every packet to ensure their content hasn't been tempered in transit. This option is disabled by default for
<figure><img src="image_6.png" /><figcaption>Fig. 5. Practical password cracking using Hashcat</figcaption></figure>

performance reasons (this security option downgrading performance from 10% to 15% according to the Microsoft documentation).

Turning Packet Signing on has no effect on the French Kiss attack: we shall see later in this paper that it does prevent relaying of SMB connections, but when connecting to a remote share on the internet, this feature provides no additional security since credentials are still sent as part of the initial SMB authentication.

## 3 Menage a Trois

The second avenue of exploitation with SMB is to relay a connection established between the victim's client and the attacker controlled SMB server to a third machine accepting NTLMv2 authentication and somehow part of the victim's network (since it needs to accept those valid user credentials). The original exploit from the Cult of the Dead Cow[5] performing over NetBIOS/UDP has already been extended to work across protocols in LANs. As a matter of fact, all the existing SMB relaying exploits involving Internet routable protocols (IP) would work without any modifications, in the attack scenario of an attacker present on the Internet.

Assuming the attacker can find a remote SMB share on a public IP and part of the victim's Forest, no further development would be required: a typical SMB relay would allow an attacker to execute arbitrary remote commands on the target SMB server thanks for instance to psexec. Those tend to be fairly rare for obvious security reasons, but extensions of this attack to relay SMB to https (eg: to connect to an Exchange Server accepting NTLM based authentication over https) already exist publicly. A quick search on the popular ShodanHQ search engine returns thousands of such servers on the internet, as seen on figure 6.⁶⁷

For the purpose of this paper however, we decided to extend existing relaying attacks to Exchange Servers, in order to obtain a complete remote user impersonation. As a matter of fact, Windows allows since Windows Server 2008 the use of Exchange mail servers over https. Since the core authentication mechanism is still based on NTLMv2, it is possible for an attacker to create a dummy SMB share on the internet, and relay connections to an Exchange Server (using SMB/NTLM over HTTP authentication) on the victim's Corporate network and obtain full access to the victim's mailbox.

⁶ The astute reader will notice that the vast majority of those services do NOT use SSL encryption, leaving in addition their users vulnerable to sniffing of credentials over the internet.

⁷ The astute reader will also have noticed that the first server in the list happens to belong to a firm recently in the News for having been hacked in Epic proportions. We will let the reader jump to conclusions if they please to. We have no concrete evidence ourselves that this is in fact what happened.
<figure><img src="image_6.png" /><figcaption>Fig. 5. Practical password cracking using Hashcat</figcaption></figure>

performance reasons (this security option downgrading performance from 10% to 15% according to the Microsoft documentation).

Turning Packet Signing on has no effect on the French Kiss attack: we shall see later in this paper that it does prevent relaying of SMB connections, but when connecting to a remote share on the internet, this feature provides no additional security since credentials are still sent as part of the initial SMB authentication.

## 3 Menage a Trois

The second avenue of exploitation with SMB is to relay a connection established between the victim's client and the attacker controlled SMB server to a third machine accepting NTLMv2 authentication and somehow part of the victim's network (since it needs to accept those valid user credentials). The original exploit from the Cult of the Dead Cow[5] performing over NetBIOS/UDP has already been extended to work across protocols in LANs. As a matter of fact, all the existing SMB relaying exploits involving Internet routable protocols (IP) would work without any modifications, in the attack scenario of an attacker present on the Internet.

Assuming the attacker can find a remote SMB share on a public IP and part of the victim's Forest, no further development would be required: a typical SMB relay would allow an attacker to execute arbitrary remote commands on the target SMB server thanks for instance to psexec. Those tend to be fairly rare for obvious security reasons, but extensions of this attack to relay SMB to https (eg: to connect to an Exchange Server accepting NTLM based authentication over https) already exist publicly. A quick search on the popular ShodanHQ search engine returns thousands of such servers on the internet, as seen on figure 6.⁶⁷

For the purpose of this paper however, we decided to extend existing relaying attacks to Exchange Servers, in order to obtain a complete remote user impersonation. As a matter of fact, Windows allows since Windows Server 2008 the use of Exchange mail servers over https. Since the core authentication mechanism is still based on NTLMv2, it is possible for an attacker to create a dummy SMB share on the internet, and relay connections to an Exchange Server (using SMB/NTLM over HTTP authentication) on the victim's Corporate network and obtain full access to the victim's mailbox.

⁶ The astute reader will notice that the vast majority of those services do NOT use SSL encryption, leaving in addition their users vulnerable to sniffing of credentials over the internet.

⁷ The astute reader will also have noticed that the first server in the list happens to belong to a firm recently in the News for having been hacked in Epic proportions. We will let the reader jump to conclusions if they please to. We have no concrete evidence ourselves that this is in fact what happened.
<figure><img src="image_7.png" /><figcaption>Fig. 6. Http(s) servers accepting relaying from SMB on the internet</figcaption></figure>

The screenshot in figure 7 shows our Menage a Trois attack being performed over the internet, in order to connect back to an Exchange Mail Server.

## 4 Other triggers

If Internet Explorer is an obvious target to those attacks, any Windows client accepting a file:// or \\prefixed URI is vulnerable too. The authors have successfully triggered the vulnerabilities on Outlook.

The Cylance team has recently published[12] a list of software vulnerable to similar issues, including in particular: Adobe Reader, Apple QuickTime and Apple Software Update (iTunes), Internet Explorer, Windows Media Player, Excel 2010, Microsoft Baseline Security Analyzer, Symantec AVs, Norton Security Scan, AVG Free, BitDefender Free, Comodo Antivirus, .NET Reflector, Maltego CE, Box Sync, TeamViewer, Github for Windows, PyCharm, IntelliJ IDEA, PHP Storm, JDK 8u31, Pondicherry, and more.

While the authors couldn't possibly verify Cylance's claim that all of those products can be tricked into performing outgoing SMB connections<fnref n="8" />, this claim seems technically reasonable.

## 5 Mitigation

The official documentation from Microsoft encourages network administrators to remediate SMB packets by blocking SMB traffic at perimeter level by dropping outgoing SMB packets on ports 137/138/139/445.

While this is certainly a good practice, it is no longer sufficient in the age of desktops mobility: a laptop part of a corporate Active Directory domain<fnref n="9" /> and brought home by its owner would remain totally

<footnote n="8">⁸ Using an XXE trigger like Cylance did, or in any other way.</footnote>

<footnote n="9">⁹ This is the case of virtually any Windows laptop in a corporate environment.</footnote>
<figure><img src="image_7.png" /><figcaption>Fig. 6. Http(s) servers accepting relaying from SMB on the internet</figcaption></figure>

The screenshot in figure 7 shows our Menage a Trois attack being performed over the internet, in order to connect back to an Exchange Mail Server.

## 4 Other triggers

If Internet Explorer is an obvious target to those attacks, any Windows client accepting a file:// or \\prefixed URI is vulnerable too. The authors have successfully triggered the vulnerabilities on Outlook.

The Cylance team has recently published[12] a list of software vulnerable to similar issues, including in particular: Adobe Reader, Apple QuickTime and Apple Software Update (iTunes), Internet Explorer, Windows Media Player, Excel 2010, Microsoft Baseline Security Analyzer, Symantec AVs, Norton Security Scan, AVG Free, BitDefender Free, Comodo Antivirus, .NET Reflector, Maltego CE, Box Sync, TeamViewer, Github for Windows, PyCharm, IntelliJ IDEA, PHP Storm, JDK 8u31, Pondicherry, and more.

While the authors couldn't possibly verify Cylance's claim that all of those products can be tricked into performing outgoing SMB connections<fnref n="8" />, this claim seems technically reasonable.

## 5 Mitigation

The official documentation from Microsoft encourages network administrators to remediate SMB packets by blocking SMB traffic at perimeter level by dropping outgoing SMB packets on ports 137/138/139/445.

While this is certainly a good practice, it is no longer sufficient in the age of desktops mobility: a laptop part of a corporate Active Directory domain<fnref n="9" /> and brought home by its owner would remain totally

<footnote n="8">⁸ Using an XXE trigger like Cylance did, or in any other way.</footnote>

<footnote n="9">⁹ This is the case of virtually any Windows laptop in a corporate environment.</footnote>
<figure><img src="image_8.png" /><figcaption>Fig. 7. Menage a Trois attack being performed to an Exchange Web Access endpoint</figcaption></figure>

vulnerable to both the French Kiss and the Menage a Trois attacks when used outside the corporate network.

In addition to network perimeter firewalls, we therefore advocate for a host based hardening thanks to the Windows Firewall present in any Windows machine running at least Windows XP SP2. By enforcing egress filtering on ports 137/138/139/445 and dropping any IP packet leaving the host with a destination matching any of those ports and having a public IP as a target host, we offer a more consistent protection against those attacks.

Increasing password lengths over 9 characters and increasing passwords complexity does offer an additional protection against French Kiss attacks (hash cracking), but none against SMB Relaying.

Finally, enabling Packet Signing on SMB helps remediating trivial SMB relaying, but since incoming SMB connections then only get terminated once user credentials have been sent over the Internet, they offer no sound remediation against neither of the attacks presented in this paper.

## 6 Conclusion

We've detailed in this white paper an extension of SMB attacks allowing credentials theft and user impersonation from the internet. Since virtually any Windows machine part of a corporate network uses IE as a default web browser and is typically part of an Active Directory network, the magnitude of this vulnerability is unprecedented.

In order to remediate this vulnerability in absence of a patch, we advocate for host based Firewall hardening and increased password complexity, as well as enabling SMB Packet Signing wherever applicable.

## 7 Acknowledgements

The authors would like to thank the Microsoft Security Response Center for the time and efforts spent on working jointly on those vulnerabilities among others over the 9 months or so before the publication of this paper, and for encouraging us to disclose those vulnerabilities and their remediationâžs in order to increase network administrators and end users awareness.
<figure><img src="image_8.png" /><figcaption>Fig. 7. Menage a Trois attack being performed to an Exchange Web Access endpoint</figcaption></figure>

vulnerable to both the French Kiss and the Menage a Trois attacks when used outside the corporate network.

In addition to network perimeter firewalls, we therefore advocate for a host based hardening thanks to the Windows Firewall present in any Windows machine running at least Windows XP SP2. By enforcing egress filtering on ports 137/138/139/445 and dropping any IP packet leaving the host with a destination matching any of those ports and having a public IP as a target host, we offer a more consistent protection against those attacks.

Increasing password lengths over 9 characters and increasing passwords complexity does offer an additional protection against French Kiss attacks (hash cracking), but none against SMB Relaying.

Finally, enabling Packet Signing on SMB helps remediating trivial SMB relaying, but since incoming SMB connections then only get terminated once user credentials have been sent over the Internet, they offer no sound remediation against neither of the attacks presented in this paper.

## 6 Conclusion

We've detailed in this white paper an extension of SMB attacks allowing credentials theft and user impersonation from the internet. Since virtually any Windows machine part of a corporate network uses IE as a default web browser and is typically part of an Active Directory network, the magnitude of this vulnerability is unprecedented.

In order to remediate this vulnerability in absence of a patch, we advocate for host based Firewall hardening and increased password complexity, as well as enabling SMB Packet Signing wherever applicable.

## 7 Acknowledgements

The authors would like to thank the Microsoft Security Response Center for the time and efforts spent on working jointly on those vulnerabilities among others over the 9 months or so before the publication of this paper, and for encouraging us to disclose those vulnerabilities and their remediationâžs in order to increase network administrators and end users awareness.
References

1. Samba: (Samba project)

2. Microsoft: [ms-cifs]: Common internet file system (cifs) protocol (1988)

3. Microsoft: [ms-smb]: Server message block (smb) protocol (2014)

4. Microsoft: [ms-smb2]: Server message block (smb) protocol versions 2 and 3 (2014)

5. SirDystic: Cult of the dead cow : Smbrelay (2001)

6. Metasploit: (Smb relays auxiliary modules)

7. Sutherland, S.: Executing smb relay attacks via sql server using metasploit (2012)

8. Gaffie, L.: Fuzzing : the smb case, Hackito Ergo Sum Conference (2014)

9. Gaffie, L.: Bsod in smb v2, Hackito Ergo Sum Conference (2011)

10. Suiche, M.: (Windows vista and windows server 2008 smbv2 remote code execution, cve-2009-2532)

11. Hashcat: (Hashcat, advanced password cracking)

12. Cylance: Redirect to smb (2015)
References

1. Samba: (Samba project)

2. Microsoft: [ms-cifs]: Common internet file system (cifs) protocol (1988)

3. Microsoft: [ms-smb]: Server message block (smb) protocol (2014)

4. Microsoft: [ms-smb2]: Server message block (smb) protocol versions 2 and 3 (2014)

5. SirDystic: Cult of the dead cow : Smbrelay (2001)

6. Metasploit: (Smb relays auxiliary modules)

7. Sutherland, S.: Executing smb relay attacks via sql server using metasploit (2012)

8. Gaffie, L.: Fuzzing : the smb case, Hackito Ergo Sum Conference (2014)

9. Gaffie, L.: Bsod in smb v2, Hackito Ergo Sum Conference (2011)

10. Suiche, M.: (Windows vista and windows server 2008 smbv2 remote code execution, cve-2009-2532)

11. Hashcat: (Hashcat, advanced password cracking)

12. Cylance: Redirect to smb (2015)