Metasploit smb_login fails with status_logon_failure

If you are using Metasploit and have ever tried running the smb_login module against a Windows XP box, chances are high that you have encountered the following error message.

STATUS_LOGON_FAILURE (Command=115 WordCount=0)

This will happen if you are running Windows XP in a non-domain environment. When running in non-domain environments, Windows authenticates all network logon requests to be authenticated as Guest instead of the local user account.

Network Access : Sharing and security model for local accounts

To fix this,

Start -> Run

gpedit.msc

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options

And in there, change the value of

Network access : Sharing and security model for local accounts,

from

Guest only - local users authenticate as Guest 
to
Classic - local users authenticate as themselves

That’s it, and you are done.

Running the scan again, results in success.

smb_login_success — Success, SMB_Login Worked!

Posted

Metasploit

Security Jedi

Tags:

Comments

2 responses to “Metasploit smb_login fails with status_logon_failure”

Imnoob

can someone explain what happens while we are changing it.

Reply
1. Security Jedi
  
  From the Microsoft website,
  
  When the value of this policy setting is Guest only – local users authenticate as Guest, any user who can access your computer over the network does so with Guest user rights. This means that they will probably be unable to write to shared folders. Although this does increase security, it makes it impossible for authorized users to access shared resources on those systems. When the value is Classic – local users authenticate as themselves, local accounts must be password-protected; otherwise, anyone can use those user accounts to access shared system resources.
  
  Hope this helps!
  
  Reply

Metasploit smb_login fails with status_logon_failure

Comments

2 responses to “Metasploit smb_login fails with status_logon_failure”

Leave a Reply Cancel reply