IPC$ Share accessible by U-admin P-admin

[J0eS4y]

9.3 w/AD integration

SMB Brute Force Logins With Default Credentials on Port 445

Vulnerability Detection Result
It was possible to login with the following credentials via the SMB protocol. <User>:<Pass↵
word>

admin:admin
&
administrator:administrator

Is there any way to mitigate this?

Thanks in advanced.

 

[Mirfster]

Just checking, but is the FreeNAS Server an AD Member or running as the AD Server?

 

[J0eS4y]

No sir - AD Integration is enabled but its only used as a CIFS/SMB server for storage.

Scanned my entire storage network and the same issue only appears on a different FreeNas 9.3 box.

Scanned with OpenVAS and confirmed via cli

Here is the OID you can probably test against your box as well.

Name: SMB Brute Force Logins With Default Credentials
Config:
Family: Default Accounts
OID: 1.3.6.1.4.1.25623.1.0.804449

 

[Mirfster]

Thanks, I will test when I get some time set aside. In the meantime, can you report this as a bug (https://bugs.freenas.org/) and see what the devs have to say about it? Wonder if this is also in FreeNAS 10 Beta as well..

Lastly, if you do post a bug; please update this post with a link to it.

 

[J0eS4y]

Done - I opened a bug report per your request.

Bug # 17278

Thank you.