topic Re: SMB Domain Information via NMAP in Network Access Control

SMB Domain Information via NMAP

paul — Fri, 29 Jun 2018 12:53:59 GMT

I am starting to play around with SMB information more for profiling. When I scan my domain joined machines I am not getting the domain information:

SMB.cpe cpe:/o:microsoft:windows_10::-

SMB.lanmanager Windows 10 Enterprise 6.3

SMB.operating-system Windows 10 Enterprise 15063

SMB.server IUSCCCATO1\x00

I have seen workgroup information show up for non-domain joined devices and domain joined information show up for devices not in the domain ISE is a part of. If I do a scan using Zenmap I get the domain information of from the device just fine. I am scanning from a non-domain joined device with Zenmap so I know there are no special permissions required.

Any thoughts would be appreciated.

Re: SMB Domain Information via NMAP

paul — Fri, 29 Jun 2018 17:59:14 GMT

As an example here is what Zenmap gets from scanning a system with the SMB script:

| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)

| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional

| Computer name: UHAOC--PHOTOID

| NetBIOS computer name: UHAOC--PHOTOID\x00

| Domain name: chp.clarian.org

| Forest name: clarian.org

| FQDN: UHAOC--PHOTOID.chp.clarian.org

There should be no reason ISE isn't getting that data. The SMB domain field is already a NMAP variable defined in ISE.

Re: SMB Domain Information via NMAP

hslai — Sat, 30 Jun 2018 01:43:45 GMT

When I allowing TCP 139 and 445 only from ISE to a domain Windows computer, I got the info on the specific ports only. When I disable the Windows Firewall on the domain Windows computer, I got the host script results with the OS and Domain info; e.g.

SMB.cpe	cpe:/o:microsoft:windows_10::-
SMB.fqdn	wx-corp.demo.local
SMB.lanmanager	Windows 10 Enterprise 2016 LTSB 6.3
SMB.operating-system	Windows 10 Enterprise 2016 LTSB 14393
SMB.server	WX-CORP\x00
SMB.workgroup	DEMO\x00

Re: SMB Domain Information via NMAP

paul — Sat, 30 Jun 2018 01:46:19 GMT

Why is ISE not pulling SMB domain. Use Zenmap SMB OS script it is all available.

Sent from my iPhone

Re: SMB Domain Information via NMAP

hslai — Sat, 30 Jun 2018 02:44:01 GMT

I believe the system where you ran Zenmap SMB OS script has more access than ISE. Please ensure these ports are allowed from ISE to the endpoints:

T:445,139,U:137

Re: SMB Domain Information via NMAP

hslai — Sat, 30 Jun 2018 03:12:44 GMT

Regarding no SMB domain or forest, it's a known issue -- CSCuy27476, which might take a couple of days to be visible to you.