Tenable Research Release Highlights

Forum Discussion

ibelyna's avatar
ibelyna
3 years ago

Nessus can now use Kerberos for DCOM Authentication Summary...

Nessus can now use Kerberos for DCOM Authentication

Summary

Nessus scans that are provided with Windows Kerberos credentials will now use the Kerberos protocol for authentication in plugins that use DCOM or WMI.  Kerberos authentication has been available for a long time in Nessus for plugins that only use SMB.  Prior to this change the DCOM/WMI plugins would authenticate using NTLM even if only a Kerberos credential was provided.  Microsoft Windows is abandoning NTLM due to security concerns and has recommended host and domain configuration that excludes the use of NTLM.

Change

This implementation of Kerberos for DCOM/WMI only supports the packet integrity authentication level (RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) which is the minimum required since Microsoft hardened DCOM to address CVE-2021-26414.  If a server or service requires packet privacy (RPC_C_AUTHN_LEVEL_PKT_PRIVACY), Nessus will not be able to scan it.

Following the deprecation of SHA1 hashes, Kerberos will slowly be updated to use SHA2 hashes on Windows and other platforms.  At this time the Nessus implementation does not support SHA2 based checksums or encryption.

Future Tenable plans include upgrading the Nessus DCOM implementation to use packet privacy and upgrading the Nessus Kerberos implementation to use SHA2 based cryptography.

Target Release Date

Immediate

Microsoft
Target

1 Reply

  • esearle's avatar
    esearle
    Connect Contributor
    2 years ago

    Will this also support Kerberos armoring. AKA FAST?

    We use the GPO setting "KDC support for claims, compound authentication for Dynamic Access Control and Kerberos armoring: Fail unarmored authentication requests"

    It appears that Nessus Professional is incapable of using compound authentication for Kerberos. This is also knows as Flexible Authentication Secure Tunneling (FAST) for Kerberos

    See MS Documentation at https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831747(v=ws.11) 

    And also https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/additional-mitigations#kerberos-armoring

    Can you confirm? If it does not support it, then how do we request this to be supported? This was available from MS back in 2012, over 10 years ago. 

    Thanks,

    Eli