NHS hit hard by ransomware / Wannacry Patching

[mullet_man]

Has anyone contacted Cunninghams? Am not sure what version our revals/tills are?

 

Think they are Win 7?

[Garacesh]

Has anyone contacted Cunninghams? Am not sure what version our revals/tills are?

 

Think they are Win 7?

 

Our Cunninghams revals are still operating fine with SMBv1 disabled on the server they connect to.

[mrbios]

Has anyone contacted Cunninghams? Am not sure what version our revals/tills are?

 

Think they are Win 7?

 

Scan their addresses with this script: https://gist.github.com/iwikmai/65b8a5b882e782d78fc5f466dfd2cde4 (you need to install nmap and put the nmap script into the scripts folder first)

 

That should tell you if they're vulnerable to the exploit.

[Bob_the_Goon]

Has anyone contacted Cunninghams? Am not sure what version our revals/tills are?

 

Think they are Win 7?

Cunninghams isn't our supplier however I went and manually patched our revals and tills. This caused no issues.

[Arthur]

I essentially want to generate traffic and thus have a positive check that a server is not responding with "SMB v1? Hell yes, let's go!".

Ah. I see what you mean now. Perhaps there's something included with Kali Linux that can generate SMB1 traffic?

[pcstru]

Ah. I see what you mean now. Perhaps there's something included with Kali Linux that can generate SMB1 traffic?

I believe the powershell NMap + Plugin posted by @mrbios here should be just the job.

[jmak]

For me it's mitigation against someone finding a laptop in a cupboard that's been hiding for too long to have received the patch or where the update has failed to install.

 

So having tested this, it prevents access to network shares and the print server on our 2008 R2 server from Windows 7 clients on our network. If I re-enable SMB1 all is hunky dory again. Any ideas? I can't see why they need SMB1.

 

I've also borked my Windows 8.1 PC - it now can't see a DC, which means I can't use Hyper-V manager or even NETLOGON. I used powershell to disable SMB1, but have since re-enabled it and checked that it is running. I can ping the servers and access them via RDP. Also no network shares or print.... Thinking I might rebuild it, funnily enough haven't really got time to do that today.

[Garacesh]

Turning off SMBv1 buggered our deployment momentarily, newly-imaged machines wouldn't map the deployment share to finish the setup (applications etc).

Forcing SMBv2 enabled on the workstations has fixed that.

 

[GPO/Registry] For Windows 7, that's:

Action: Update

Hive: HKEY_LOCAL_MACHINE

Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Value name: SMB2

Value type: REG_DWORD

Value data: 1

Base: Decimal

Edited May 17, 2017 by Garacesh

[pbad]

So I have checked using WSUS and the updates to fix the SMB1 vulnerability have been installed on all the Windows 7 Clients on Windows Server 2008 and Windows Server 2008 R2.

 

Now I’m trying to disable SMBv1 as recommended by Microsoft and everyone else in this thread but when I disable SMBv1 on the Windows 7 Clients, the mapped drives are not connected and any shares are not connected such as redirected desktops and redirected start menu folder.

 

I have added the following registry settings to Windows Server 2008 and Windows Server 2008 R2:

 

Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1

REG_DWORD: 0 = Disabled

 

To enable or disable SMBv2 on the SMB server, configure the following registry key:

Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB2

REG_DWORD: 1 = Enabled

 

I have then disabled SMBv1 on Windows 7 Client using:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

I have then enable SMBv2/v3 on Windows 7 Client using:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

 

I have restarted the Windows 7 client and when I login there are no mapped drives, no redirected desktop or redirected start menu.

 

What am I doing wrong?

[googlemad]

We got a letter from some guy high up in the NHS today thanking the IT teams attached to an email as a PDF file.

 

Hang on...someone thanking the IT team?! Suspicious email, deleteee!

[ozydave]

We got a letter from some guy high up in the NHS today thanking the IT teams attached to an email as a PDF file.

 

Hang on...someone thanking the IT team?! Suspicious email, deleteee!

 

That surely has to be a new kinda virus - possibly called the "Bloody Hell" strain

[smarties11]

So I have checked using WSUS and the updates to fix the SMB1 vulnerability have been installed on all the Windows 7 Clients on Windows Server 2008 and Windows Server 2008 R2.

 

Now I’m trying to disable SMBv1 as recommended by Microsoft and everyone else in this thread but when I disable SMBv1 on the Windows 7 Clients, the mapped drives are not connected and any shares are not connected such as redirected desktops and redirected start menu folder.

 

I have added the following registry settings to Windows Server 2008 and Windows Server 2008 R2:

 

Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1

REG_DWORD: 0 = Disabled

 

To enable or disable SMBv2 on the SMB server, configure the following registry key:

Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB2

REG_DWORD: 1 = Enabled

 

I have then disabled SMBv1 on Windows 7 Client using:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

I have then enable SMBv2/v3 on Windows 7 Client using:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

 

I have restarted the Windows 7 client and when I login there are no mapped drives, no redirected desktop or redirected start menu.

 

What am I doing wrong?

 

I've not disabled SMB 1 on our site but the way I read the command you have used to enable SMB 2 (BTW SMB 3 doesn't exist in 7) is that you are setting the lanmanworkstation service to depend on SMB 1 and SMB 2 however you've previously disabled the SMB 1 service and hence that will prevent lanmanworkstation from starting. However, I see that the command you have used is as per the MS article. I personally would suggest trying for your enabling of smb2

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

[pbad]

I've not disabled SMB 1 on our site but the way I read the command you have used to enable SMB 2 (BTW SMB 3 doesn't exist in 7) is that you are setting the lanmanworkstation service to depend on SMB 1 and SMB 2 however you've previously disabled the SMB 1 service and hence that will prevent lanmanworkstation from starting. However, I see that the command you have used is as per the MS article. I personally would suggest trying for your enabling of smb2

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

 

Thanks all working now!

[smarties11]

Thanks all working now!

 

No problem, pleased it worked for you. Not quite sure why Microsoft have got it wrong in their article but still.....

[JordanT91]

Does anyone know how ransomware affects SharePoint? I use Webdav to map network locations (not drives) to sites on our SharePoint server (on-premises) but it seems there isn't really a concensus on how a) mapped network locations and b) SharePoint reacts to ransomware (because all the content is inside a databse rather than a traditional file structure).

[timbo343]

We have a 4 buffalo terastations and 1 synology box that we use for our backups. It seems the Terastations only use SMB1.

 

On our Server 2008R2 boxes we run the following code to disable the SMB1 client:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

and also run the following code to make sure the SMB2 & 3 clients are enabled:

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

 

and restart the 2008R2 server. We find that we cannot connect to the Buffalo Terastations however we can connect to the Synology box as the synology box is running SMB2 as it's minimum SMB Protocol. Changing this so that the Min and Max protocols to SMB1 breaks the connect from our servers so we know that this is working as it should - set the min protocol back to SMB2 and max to SMB3.

 

The same happens with the 2012R2 machine, we disable the SMB1 client by running:

 

remove-windowsfeature -name fs-smb1

 

Questions:

1. Can we get away with having 2017-05 (kb4019264) installed and the SMB1 client still enabled on servers so we can perform backups to the buffalo drives? If not, we may have to fork out for synology enclosures to replace these buffalo NASs and take out the drives from the Buffalos and put them in to the Synologys.

 

2. Am i also right in thinking that we should be applying the reg hack and running the powershell script to all machines on the network or only to machines that are hosting network shares / sharing folders?

 

To enable or disable SMBv1 on the SMB server, configure the following registry key:

Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1

REG_DWORD: 0 = Disabled

REG_DWORD: 1 = Enabled

Default: 1 = Enabled

 

To enable or disable SMBv2 on the SMB server, configure the following registry key:

Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB2

REG_DWORD: 0 = Disabled

REG_DWORD: 1 = Enabled

Default: 1 = Enabled

 

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Edited May 18, 2017 by timbo343

[Garacesh]

2. Am i also right in thinking that we should be applying the reg hack and running the powershell script to all machines on the network or only to machines that are hosting network shares / sharing folders?

 

I would recommend so, yes. Your servers might not be able to get infected, but all it takes is a client with write privileges getting infected on a vulnerable workstation and you get the same end-result.

[timbo343]

I would recommend so, yes. Your servers might not be able to get infected, but all it takes is a client with write privileges getting infected on a vulnerable workstation and you get the same end-result.

 

Yes to which part of the question? To All machines or only to those that are hosting file shares?

[Garacesh]

Yes to which part of the question? To All machines or only to those that are hosting file shares?

 

Apologies. Yes, I'd personally say disable SMBv1 everywhere. That's what I've done here.

If your fileserver has SMBv1 disabled, this means WannaCry can't propagate to the server and infect it. But that isn't enough to ensure the files it hosts are protected. If a standard workstation is infected, files on the file server will likely* still get encrypted wherever the users on that machine have Write permissions.

 

* I don't actually know if WannaCry encrypts network shares, but I know that certainly other flavours of ransomware do.

[ozydave]

Morning,

 

I'm not great with Mac's so any help would be great.

Students log on with their AD credentials and have their windows document shares mapped and a mapping to my papercut print server.

 

Disabling SMBv1 on my windows serves now breaks the mapping of the shares. We are using workgroup manager on the Mac server.

 

I have applied the Microsoft patch to plug SMBv1 but as MS say I need to disable it.

 

Any offers on how I can get round the mapping issue?

 

Cheers

[timbo343]

so to clarify and just so i get this right:

 

Run this everywhere which i already had set:

To enable or disable SMBv1 on the SMB server, configure the following registry key:

Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1

REG_DWORD: 0 = Disabled

REG_DWORD: 1 = Enabled

Default: 1 = Enabled

 

To enable or disable SMBv2 on the SMB server, configure the following registry key:

Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB2

REG_DWORD: 0 = Disabled

REG_DWORD: 1 = Enabled

Default: 1 = Enabled

 

On Server 2012R2 / 2016 only:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

 

which stops any machines acting as a SMB1 host for folder sharing.

 

-------------------------------------------------------------------------------------------

 

On machines running windows 10, run the following to disable the SMB1 client:

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

which prevents windows 10 machines from accessing the SMB1 shares, so running this on any windows 10 machine and try to connect to the buffalo NASs as they run SMB1, the connection fails.

 

If we have 2017-05 installed on the client machines, do we have to run Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol and can we keep the SMB1 clients enabled?

 

To repeat question 1 from above:

1. Can we get away with having 2017-05 (kb4019264) installed and the SMB1 client still enabled on servers so we can perform backups to the buffalo drives?

Edited May 18, 2017 by timbo343

[ollyyllo]

On Server 2012R2 / 2016 only:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

which stops any machines acting as a SMB1 host for folder sharing.

 

-------------------------------------------------------------------------------------------

 

On machines running windows 10, run the following to disable the SMB1 client:

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

which prevents windows 10 machines from accessing the SMB1 shares, so running this on any windows 10 machine and try to connect to the buffalo NASs as they run SMB1, the connection fails.

 

This is what I have done also, but when I run

 

Get-SmbServerConfiguration | Select EnableSMB1Protocol

 

on a Windows 10 machine it returns True

 

Does this mean Windows 10 can still act a a SMBv1 host?

[timbo343]

This is what I have done also, but when I run

 

Get-SmbServerConfiguration | Select EnableSMB1Protocol

 

on a Windows 10 machine it returns True

 

Does this mean Windows 10 can still act a a SMBv1 host?

 

For you, you need to have SMB1 = 0 listed as a DWORD in the registry.

 

The command Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol stops the machine using the SMB1 client to connect to shares so if you have a NAS that only uses SMB1 for its folder share, the you won't be able to connect.

 

I need to know if we can have the client still enabled if we have the latest patches applied?

[3s-gtech]

Yes, you can. That's not to say that SMB v1 is a good thing - going forward, it needs to be retired. More flaws and holes may well appear. If you need it to connect to old NASs, start saving for new ones.

[timbo343]

Yes, you can. That's not to say that SMB v1 is a good thing - going forward, it needs to be retired. More flaws and holes may well appear. If you need it to connect to old NASs, start saving for new ones.

 

Thank god for that, That's the plan, to replace devices that use the SMB1 protocol - like the buffalo terastations Ive not got a bad word to say against them, just that they don't support newer protocols.