SMB NULL Session Authentication

# check-nullsession.ps1

# Purpose: Triage whether a Windows host is likely vulnerable to SMB NULL session exposure.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-RegValue {
    param(
        [string]$Path,
        [string]$Name
    )
    try {
        $item = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop
        return $item.$Name
    }
    catch {
        return $null
    }
}

try {
    $lanmanPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
    $lsaPath    = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'

    $restrictNullSessAccess = Get-RegValue -Path $lanmanPath -Name 'RestrictNullSessAccess'
    $nullSessionPipes       = Get-RegValue -Path $lanmanPath -Name 'NullSessionPipes'
    $nullSessionShares      = Get-RegValue -Path $lanmanPath -Name 'NullSessionShares'
    $everyoneIncludesAnon   = Get-RegValue -Path $lsaPath    -Name 'EveryoneIncludesAnonymous'
    $restrictAnonymous      = Get-RegValue -Path $lsaPath    -Name 'RestrictAnonymous'

    $service = Get-Service -Name 'LanmanServer' -ErrorAction SilentlyContinue
    if (-not $service) {
        Write-Output 'UNKNOWN - Server service (LanmanServer) not found'
        exit 2
    }

    # Normalize multi-string values

    if ($nullSessionPipes -isnot [System.Array] -and $nullSessionPipes) {
        $nullSessionPipes = @($nullSessionPipes)
    }
    if ($nullSessionShares -isnot [System.Array] -and $nullSessionShares) {
        $nullSessionShares = @($nullSessionShares)
    }

    $reasons = @()
    $unknown = @()

    if ($restrictNullSessAccess -eq $null) {
        $unknown += 'RestrictNullSessAccess missing'
    } elseif ([int]$restrictNullSessAccess -ne 1) {
        $reasons += 'RestrictNullSessAccess is not enabled (expected 1)'
    }

    if ($nullSessionPipes -and $nullSessionPipes.Count -gt 0) {
        $reasons += ('Anonymous named pipes configured: ' + ($nullSessionPipes -join ', '))
    }

    if ($nullSessionShares -and $nullSessionShares.Count -gt 0) {
        $reasons += ('Anonymous shares configured: ' + ($nullSessionShares -join ', '))
    }

    if ($everyoneIncludesAnon -ne $null -and [int]$everyoneIncludesAnon -eq 1) {
        $reasons += 'EveryoneIncludesAnonymous is enabled'
    }

    if ($restrictAnonymous -eq $null) {
        $unknown += 'RestrictAnonymous missing'
    } elseif ([int]$restrictAnonymous -lt 1) {
        $reasons += 'RestrictAnonymous is permissive (< 1)'
    }

    if ($reasons.Count -gt 0) {
        Write-Output ('VULNERABLE - ' + ($reasons -join '; '))
        exit 1
    }

    if ($unknown.Count -gt 0) {
        Write-Output ('UNKNOWN - ' + ($unknown -join '; ') + '. No explicit insecure settings found, but the registry state is incomplete for a confident verdict.')
        exit 2
    }

    Write-Output 'PATCHED - Anonymous pipe/share access appears restricted and no permissive null-session settings were found'
    exit 0
}
catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}