lin-rexter / netbios-smb-management Goto Github PK

It provides services related to the session layer of the OSI model allowing
applications on separate computers to communicate over a local area network.
As strictly an API, NetBIOS is not a networking protocol.
NetBIOS normally runs over TCP/IP via the NetBIOS over TCP/IP (NBT) protocol.

SMB is a communication protocol used for sharing access to files, printers,
serial ports and other resources on a network,operates at the application layer,
but relies on lower network levels for transport and 
was originally designed to run on top of NetBIOS over TCP/IP (NBT)
using TCP port 139 and UDP ports 137 and 138,designed by Barry Feigenbaum at IBM in 1983.
Since Windows 2000,SMB runs directly over TCP/IP and uses port 445.

CIFS is an early dialect of the SMB(1.0) protocol and added more features,support direct connections over TCP port 445
without requiring NetBIOS as a transport(a largely experimental effort that required further refinement),
created by Microsoft in 1996.
CIFS was considered as a "chatty protocol" that was a huge bug and had network issues.
Microsoft has since given up on CIFS but has made SMB specifications publicly available.
CIFS is now considered obsolete, because most modern storage systems use SMBv2 or SMBv3.

The CIFS/SMBv1 is rarely used these days,most modern storage systems use SMBv2 or SMBv3.

SMB1.0 is a deprecated and insecure protocol,Microsoft has marked SMB1 as deprecated in June 2013.
Early the protocol were exploited during the WannaCry ransomware attack through a zero-day exploit called EternalBlue.
SMB1.0 has significant security vulnerabilities and strongly encourage you not to use it.

Microsoft introduced SMB2.0 protocol in 2006 with Windows Vista and Windows Server 2008.
SMB2.0 reduced chattiness to improve performance, enhanced scalability and resiliency, 
and added support for wide area network (WAN) acceleration.

SMB 2.1 was introduced with Windows Server 2008 R2 and Windows 7.
SMB 2.1 introduced minor performance enhancements with a new opportunistic locking mechanism.

SMB3.0 is part of Windows 8 and Windows Server 2012.
SMB3.0 added several significant upgrades to improve availability, 
performance, backup, security and management.
SMB3.0 introduces several security enhancements, 
such as end-to-end encryption and a new AES based signing algorithm and
transparent failover mechanism and other functional.

SMB3.0.2 was introduced in Windows 8.1 and Windows Server 2012 R2.
SMB3.0.2 can be optionally disabled SMB1.0 to increase security.

SMB 3.1.1 was introduced with Windows 10 and Windows Server 2016.
SMB 3.1.1 added pre-authentication integrity check using SHA-512 hash to 
prevent man-in-the-middle (MitM) attacks and contained various encryption improvements,
including AES-128-CCM or AES-128-GCM(new) and cluster dialect fencing, among other updates.

137(UDP): Netbios-ns NETBIOS Name Service(NBNS)(WINS).
138(UDP): Netbios-dgm NETBIOS Datagram Service.
139(TCP): Netbios-ssn NETBIOS Session Service.
445(TCP): Microsoft-DS,modern SMB (especially v2/v3) runs only on TCP port 445.

1. HKEY_LOCAL_MACHINE\Software\Microsoft\OLE > EnableDCOM -> Set N (Disabled DCOM)
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RPC > DCOM Protocols -> Clear value "ncacn_ip_tcp"
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcEptMapper > Start -> Set value "4"(Disabled-4,Manual-3,Automatic-2)
4. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs > Start -> Set value "4"(Disabled-4,Manual-3,Automatic-2)
5. 

1. 創建防火牆阻擋入站Port 137、138規則。

1. 將註冊表HKLM:\SYSTEM\CurrentControlSet\Control\Lsa當中的restrictanonymous值改成2。
2. 關閉lmhosts服務，並設置成停用狀態。
3. 關閉netbios服務，並設置成停用狀態。
4. 將註冊表HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters當中的AutoShareServer值改成0。
5. 將註冊表HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters當中的AutoShareWks值改成0。
6. 創建防火牆阻擋入站Port 139規則。

1. 將註冊表HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters當中的SMBDeviceEnabled值改成0。
2. 將註冊表HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters當中的TransportBindName值清空。
3. 關閉lanmanserver服務，並設置成停用狀態。
4. 創建防火牆阻擋入站Port 445規則。