Windows System Security Risk - Local NTLM Replay Privilege Escalation
Published: 2020-12-04
According to research and analysis by our company's security department, incidents of intruding into Windows systems using the NTLM replay mechanism have increased recently. Intruders mainly use Potato programs to attack ports with SYSTEM privileges to forge the network identity authentication process, use the NTLM replay mechanism to fraudulently obtain SYSTEM identity tokens, and ultimately obtain system privileges. Microsoft does not consider this security risk to be a vulnerability, so it will not be fixed. For the security of your server, we recommend that you make the following security adjustments:
1. Disable the DCOM function
The following steps to disable DCOM apply to win2008/2012/2016/2019
Open Control Panel->Administrative Tools->Component Services
Expand Component Services-Computers, right-click My Computer and select Properties
Click the Default Properties tab, uncheck "Enable Distributed COM on this computer", and then click OK
It is recommended that all Windows users disable this item to reduce the risk of intrusion.
You can also directly execute reg add HKLM\SOFTWARE\Microsoft\Ole /v EnableDCOM /t REG_SZ /d N /f in the command line to disable it.
2. If you are using iis, it is recommended to remove the IIS6 management compatibility in IIS
Server Manager-Manage-Remove Roles and Features
Uncheck all selections for iis6 management compatibility
Privilege escalation case: https://mp.weixin.qq.com/s/qxCoQ9Zne6CibRbJMURiFA Please be sure to pay attention to and properly configure security settings
System Security Hardening Recommendations