How to find Microsoft Windows Kerberos, NFS and Domain Controller assets

Updated

Latest Microsoft Windows vulnerability #

Microsoft recently released security updates for over 70 vulnerabilities, including 3 zero-days and 7 critical vulnerabilities that affect a wide-range of their products and services. The list of patches covers an actively exploited zero-day vulnerability in the Windows Local Security Authority (LSA), as well as vulnerabilities in Kerberos, NFS, and LDAP protocols.

What is the impact of these vulnerabilities? #

CVE-2022-26931 is a critical Kerberos vulnerability that provides an attacker with privilege elevation if successfully exploited.

CVE-2022-26937 is a critical NFS vulnerability included in the list of fixes. This vulnerability could allow an unauthenticated attacker to execute arbitrary code if successfully exploited over the network. Microsoft recommends disabling NFSV2 and NFSV3 as a means of exploit mitigation using the following PowerShell command. NFSv4.1, is not vulnerable:

powershell
PS C:\Set-NfsServerConfiguration -EnableNFSV2 $false -EnableNFSV3 $false

Although most of the LDAP vulnerabilities affect all versions of Windows, CVE-2022-29131 an authenticated attacker can exploit the vulnerability over the network on a domain controller running Windows Server 2019, Windows 10, Windows 11 (x64/arm64), or Windows Server 2022.

CVE-2022-22012 and CVE-2022-29130 are listed as important remote code execution (RCE) vulnerabilities that also affect domain controllers, specifically LDAP. Although, according to the CVSS score for both vulnerabilities, they are deemed critical. An unauthenticated attacker could send a specially crafted request to a vulnerable server that would allow the attacker to remotely execute code within the SYSTEM account context. According to Microsoft, this vulnerability can only be exploited if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value (10,485,760); otherwise, the system is not vulnerable.

CVE-2022-29139 is also listed as important and it differs from the other LDAP vulnerabilities in that it flips the RCE on its head. If an LDAP client connects to a malicious LDAP server from a Windows host, the malicious server could allow an attacker to remotely execute code within the LDAP client.

How do I find potentially vulnerable Windows Kerberos assets with runZero? #

From the Service Inventory page, use the following query to locate Windows NFS assets within your network which may need remediation or mitigation:

_asset.protocol:kerberos and protocol:kerberos and kerberos.errorCode:68 and os:windows
Find Windows Kerberos assets

How do I find potentially vulnerable Windows NFS assets with runZero? #

From the Service Inventory page, use the following query to locate Windows NFS assets within your network which may need remediation or mitigation:

_asset.protocol:nfs and protocol:nfs and os:windows
Find Windows NFS assets

How do I find potentially vulnerable Windows domain controller instances with runZero? #

From the Service Inventory page, use the following query to locate Windows domain controller assets running LDAP within your network which may need remediation or mitigation:

_asset.protocol:ldap and protocol:ldap and (has:"ldap.isSynchronized" or has:"ldap.domainControllerFunctionality") and type:server and os:windows
Find Windows domain controllers

As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.


Related Articles

Rapid Response
How to find Palo Alto Network firewalls running PAN-OS 11.1, 11.0, and 10.2
Palo Alto Networks disclosed that versions of their PAN-OS software have a vulnerability allowing for remote command injection. Here's how to find...
Rapid Response
How to find outdated lighttpd services
Outdated versions of the open source lighttpd web server are vulnerable to a handful of security vulnerabilities
Rapid Response
How to find D-Link NAS Storage devices
D-Link has disclosed multiple vulnerabilities in their D-Link NAS Storage products. Here's how to find potentially impacted devices.
Rapid Response
How to find Brocade Fabric OS
On April 4, 2024, Broadcom disclosed a vulnerability in their Fabric OS operating system used in their Brocade storage networking devices. Here's...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved