SMB exploiter only works with SMBv1 #3577
Description
Describe the bug
A user has reported that the SMB exploiter only works if SMBv1 is enabled. If SMBv1 is disabled, propagation fails with the following event:
ExploitationEvent(
source=UUID('35b9a0c6-4b32-47da-9f05-90e81c9dc4af'),
target=IPv4Address(REDACTED),
timestamp=1691594367.2392383,
tags=frozenset({'smb-exploiter', 'attack-t1021', 'attack-t1110', 'attack-t1210'}),
success=False,
exploiter_name='SMB',
error_message="Failed to authenticate over SMB with identity=Username(username='hacker') secret=Password(password=SecretStr('**********')): Error occurs while reading from remote(10054)"
)
Tasks
- Disable SMBv1 on at least one of the SMB test machines. (0d) @ilija-lazoroski
- Reproduce the issue
- Update the packer/terraform scripts as necessary
- Fix it! (0d) @ilija-lazoroski
- Copy the fix to WMI and test
Hints
I haven't investigated this much, but my money is on the preferred_dialect parameter being the cause of the issue.