1. Mitchell Adair Computer Security Group Feb. 10th, 2010 Enumerating Windows Users

2. Outline Purpose Quick Review The Old (Win2k) The New (XP and above) What is a SID? sid2user user2sid Attack Outline How do we prevent this? Demo More Info

3. Purpose Enumerate Users Password guessing Social engineering It's just useful... If we can do it, so can the bad guys We'll go over how to prevent this shortly... but first let's make sure it works ;)

4. Quick Review We'll be using SMB null sessions So first... a little background SMB = Server Message Block File sharing Printing over a network etc... TCP port 445

5. ...Quick Review You can create an SMB connection with a user account, but - you can create a null session User “” Pass “” Allowed by default C:\> net use \\host “pass” /u:”user” C:\> net use \\192.168.69.2 “” /u:”” The command completed successfully. Now... direct queries to remote hosts API

6. The Old (Win2k) By default, Win2k relies on SMB SMB includes an API Return computer info through ports 139 and 445 With Win2k, you can just pull user accounts. First, establish a null SMB session Then, remotely access API Network info, shares, users, groups, registry keys... Obviously... this is way too much info

7. ...The Old (Win2k)

8. The New (XP and above) So they got a little smarter... and the default settings no longer permit this. “The RestrictAnonymous registry value was introduced in Microsoft Windows NT 4.0 Service Pack 3 (SP3) and is now included with Windows 2000.” - microsoft.com But, let's take a closer look...

9. ...The New (2k3 and above) RestrictAnonymous has 3 values 0 – anonymous connections can enumerate … 1 - anonymous connections can not enumerate... 2 – no anonymous connections are possible “Note Even with the RestrictAnonymous registry value set to 1, there are Win32 programming interfaces that do not restrict anonymous connections. Therefore, tools that use these interfaces can still enumerate information over a null session even when the RestrictAnonymous registry value is set to 1.” - microsoft.com

10. What is a SID? SID = Security Identifier Users reference account name OS internally references a SID users, groups, and more... unique, never reused Domain accounts, accompanied by RID (Relative Identifier) Identifies a particular account or group Domain accounts SID = SID + RID SID of the domain, concatenated with account RID

11. ...What is a SID? S-1-5-32-544 This SID has four components: revision level, identifier authority, domain identifier A relative identifier 1-5-32 collectively identify a domain The last value, 544, is the Relative Identifier (RID) 500 – Administrator 501 – Guest 1001 and up – User accounts

12. sid2user Makes a different API call than the one blocked by RestrictAnonymous Performs WIN32 function LookupSidName Takes a SID, returns a user account Surely, If they know the SID, they're trustworthy sid2user.exe \\host [SID] [RID] sid2user.exe \\anonymous ## ## ## 500

13. user2sid But oh noes... we need the SID! Takes an account name, returns the SID Performs WIN32 function LookupAccountName There are well known account names... administrator, “domain users”, guest, etc... user2sid.exe \\host user2sid.exe \\anonymous guest

14. Attack Outline 1. Establish a null session 2. Use user2sid to find the SID 3. Use sid2user to iterate through known RIDs 4. You now know all the accounts on the box... ● First, let's see how to prevent this … then we'll do a quick demo :)

15. How do we prevent this? Block ports at the firewall SMB traffic shouldn't be leaving the network Block ports on the host May affect compatibility with clients, servers, apps. XP and above secpol.msc Network access: Allow anonymous SID / Name translation → Disabled Network access: Do not allow anonymous enumeration of SAM accounts → Enabled

16. DEMO

17. More Info The author of the tools http://evgenii.rudnyi.ru/soft/sid/ “How Security Identifiers Work” http://technet.microsoft.com/en- us/library/cc778824%28WS.10%29.aspx Google sid2user, user2sid Windows SID etc...