SoylentNews

Net Cease: Microsoft Researchers Unveil Anti-Reconnaissance Tool

posted by cmn32480 on Wednesday October 19 2016, @05:52PM   
from the who's-watching? dept.

MrPlow writes:

Submitted via IRC for TheMightyBuzzard

Microsoft researchers Itay Grady and Tal Be'ery have released Net Cease, a PowerShell script that prevents attackers who have already compromised an endpoint from getting information about other targets within the same corporate network.

The idea behind the script is to make attackers' lateral movement on the network more difficult.

[...] Net Cease works by changing the default permissions for the NetSessionEnum method to limit the number of domain users who are able to execute the method remotely.

"The NetCease script hardens the access to the NetSessionEnum method by removing the execute permission for Authenticated Users group and adding permissions for interactive, service and batch logon sessions," the creators explained.

This one's for all you admin types out there who have no choice but to have large numbers of Windows devices on your network.

Source: https://www.helpnetsecurity.com/2016/10/18/net-cease-network-anti-reconnaissance-tool/

---

Original Submission

• Re:And nothing of value was gained... (Score: 2, Informative) by Anonymous Coward on Wednesday October 19 2016, @06:08PM

  by Anonymous Coward on Wednesday October 19 2016, @06:08PM (#416260)

  And for those interested, below is the full script. It's pathetic that this is newsworthy in any shape, way or form.
  This isn't a "OMG, Microsoft Research makes huge strides", instead it is more along the lines of "anyone, even an intern, could have written this" (and it was likely written by an intern).

  #NetSessionEnum SecurityDescriptor Registry Key
  $key = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity"
  $name = "SrvsvcSessionInfo"
  $SRVSVC_SESSION_USER_INFO_GET = 0x00000001
  $backup = "SrvsvcSessionInfoBackup"
   
  Write-Host "Starting NetCease 1.01"
   
  #Backup original Key value if needed
  $backupVal = [Microsoft.Win32.Registry]::GetValue($key, $backup, $null)
  $srvSvcSessionInfo = [Microsoft.Win32.Registry]::GetValue($key, $name, $null)
  if ($backupVal -eq $null)
  {
      [Microsoft.Win32.Registry]::SetValue($key,$backup,$srvSvcSessionInfo)
  }
   
  #Load the SecurityDescriptor
  $csd = New-Object -TypeName System.Security.AccessControl.CommonSecurityDescriptor -ArgumentList $true,$false, $srvSvcSessionInfo,0
   
  #Remove Authenticated Users Sid permission entry from its DiscretionaryAcl (DACL)
  $authUsers = [System.Security.Principal.WellKnownSidType]::AuthenticatedUserSid
  $authUsersSid = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList $authUsers, $null
  $csd.DiscretionaryAcl.RemoveAccessSpecific([System.Security.AccessControl.AccessControlType]::Allow, $authUsersSid,$SRVSVC_SESSION_USER_INFO_GET, 0,0)
   
  #Add Access Control Entry permission for Interactive Logon Sid
  $wkt = [System.Security.Principal.WellKnownSidType]::InteractiveSid
  $interactiveUsers = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList $wkt, $null
  $csd.DiscretionaryAcl.AddAccess([System.Security.AccessControl.AccessControlType]::Allow, $interactiveUsers, $SRVSVC_SESSION_USER_INFO_GET,0,0)
   
  #Add Access Control Entry permission for Service Logon Sid
  $wkt = [System.Security.Principal.WellKnownSidType]::ServiceSid
  $serviceLogins = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList $wkt, $null
  $csd.DiscretionaryAcl.AddAccess([System.Security.AccessControl.AccessControlType]::Allow, $serviceLogins, $SRVSVC_SESSION_USER_INFO_GET,0,0)
   
  #Add Access Control Entry permission for Batch Logon Sid
  $wkt = [System.Security.Principal.WellKnownSidType]::BatchSid
  $BatchLogins = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList $wkt, $null
  $csd.DiscretionaryAcl.AddAccess([System.Security.AccessControl.AccessControlType]::Allow, $BatchLogins, $SRVSVC_SESSION_USER_INFO_GET,0,0)
   
  #Update the SecurityDescriptor in the Registry with the updated DACL
  $data = New-Object -TypeName System.Byte[] -ArgumentList $csd.BinaryLength
  $csd.GetBinaryForm($data,0)
  [Microsoft.Win32.Registry]::SetValue($key,$name,$data)
  Write-Host "Permissions successfully updated"
  Write-Host "In order for the hardening to take effect, please restart the Server service"

  Parent

  Starting Score:	0		points
  Moderation		+2
  Informative=1, Underrated=1, Total=2
  Extra 'Informative' Modifier		0
  Total Score:		2