專案資訊 #1073
已結束專案資訊 #1064: 2025-PenTest
SMB NULL Session Authentication allowed on Domain Controllers
100%
概述
"4.7.3
CWE-16
CWE-284
" "SMB NULL Session Authentication allowed on Domain Controllers
The SMB service on domain controllers allows users to authenticate using a NULL session, meaning that no user credentials need to be supplied to the server.
" "An attacker may be able to read, delete or modify important data, and depending on the configuration, it could be possible to list information about the domain such as users and groups.
" "Disallow the possibility to authenticate to the SMB server using NULL sessions, if this is not possible, do not store sensitive data in public shares.
" "Status: Open
CVSS-Score: 6.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix Difficulty: Quick Win
"
檔案
是由 周益利 於 3 個月 前更新
- 檔案 clipboard-202511271712-72kpp.png clipboard-202511271712-72kpp.png 已新增
- 狀態 從 New-新增 變更為 Resolved-解决
- 完成百分比 從 0 變更為 100
1.透過群組原則 (GPO) 停用 NULL 工作階段
2.套用至 網域控制站