Blog Post

Storage at Microsoft
11 MIN READ

SMB and Null Sessions: Why Your Pen Test is Probably Wrong

JamesKehr's avatar
JamesKehr
Icon for Microsoft rankMicrosoft
Feb 21, 2020
Hi everyone, James Kehr here with a guest post. One of the SMB cases we get regularly at Microsoft Support is, “my pen test says you allow Null sessions!” Followed by a string of CVE numbers; like, C...
Updated May 21, 2024
Version 3.0
security
auanasgheps's avatar
auanasgheps
Copper Contributor
Sep 24, 2020

JamesKehrI did a packet capture indeed, I can see NULL auths sent from my PC. The server then maps these requests as anonymous/guest.

I have posted the issue here with a screen from Wireshark too.

 

https://answers.microsoft.com/en-us/windows/forum/all/my-w10-pc-is-sending-anonymous-unauthenticated-smb/2e80b71a-67f1-4ea7-a4e9-085fbcba8e33?auth=1

(nobody has replied maybe too technical for that forum?)

 

After deep investigation I have discovered that most of these calls were made by my Antivirus (Avira Antivirus) scanning network paths, but File History (the backup feature of Windows) is producing the exact same errors. So ultimately there's something wrong with Windows when doing SMB on my behalf.

I've reproduced the issue several times in VMs with clean install and different Samba servers too.

There's something wrong here and I don't know how to report this to Microsoft.