SMB and LDAP signing, LDAPS
You measure that the DC refuses password binds over unencrypted LDAP, connect securely with StartTLS and LDAPS, read the DC certificate and prove it is self-signed and can’t be validated, and audit SMB signing, protocol versions and encryption with safe nmap scripts and smbclient; at the end you write this lab’s DC certificate identity and the hardening report. The certificate is generated anew in every lab.
Level 201 · 45 min
When a client talks to the DC there are two dangers: someone in the middle can read the conversation (confidentiality) or change it or pass it on elsewhere (integrity). The best-known example of the second is NTLM relay: the attacker catches a user’s authentication and forwards it at once to the DC or a server as that user.
The protections: signing adds a fingerprint to every packet, so a changed or relayed packet is rejected; sealing or encryption makes the content unreadable; channel binding ties the authentication to one specific TLS connection. LDAPS (636) and StartTLS encrypt LDAP traffic with TLS; but for that to work, the client must validate the server’s certificate. The figure shows these layers.
In this lesson you measure the DC. Good news: some protections are on. Bad news: in every lesson so far we connected with TLS_REQCERT never, without validating the certificate; you will see why in this lesson.
What you will do in this lesson
- Send a password over unencrypted LDAP
- Secure on the same port: StartTLS
- The DC’s certificate
- Try to validate the certificate
- Summarise the certificate with nmap
- SMB signing and versions
- SMB encryption
- This DC’s certificate identity
- The protocol hardening report
- Short quiz
Skills you will earn
- Verifying that password binds over unencrypted LDAP are refused
- Using LDAP securely with StartTLS (-ZZ)
- Reading the DC’s TLS certificate (openssl, ssl-cert)
- Showing why certificate validation is needed (TLS_REQCERT)
- Auditing SMB signing and SMB1
- Trying SMB3 encryption
- Writing a protocol hardening report
- Writing audit findings into a report
← The tiered administration model (tier 0/1/2) · Active Directory security: auditing and hardening · The krbtgt password, backup and recovery →
Start for free