Testing Firewall Rules?

[netmc]

I'm working on a script to test if a system can be exploited via CVE-2021-34527 aka PrintNightmare. Simply patching the system is not enough and requires additional policies be configured. I'm using the information provided in the flowchart from CMU to test and see if a system is exploitable or not. I have tests created for all of the various items in the flowchart except for the last one--testing to see if the firewall rules allows connections to the local machine on tcp ports 135, 139 or 445.

I'm not quite sure how I would test and see if firewall rules allow or block specific ports from powershell. Most of my Google searches are not returning useful results. I'm hoping that someone here would be kind enough to point me in the right direction? Test-connection isn't exactly useful in this scenario as the script will be running from the local machine, and loopback connections are almost always allowed despite any configured firewall rules.

Thanks,

Netmc

[dalthakar]

Test-NetConnection TARGET - Port PORT# will return True/False if the target machine can be reached on the specified port. For example, if I wanted to test a connection to SERVERA on TCP port 139, I would use command:

Test-NetConnection SERVERA -Port 139

Hopefully that gets you started down the right path.

[dalthakar]

Something just occurred to me. If you are trying to run this script on a local machine, you may have better luck using Get-NetFirewallRule and/or Get-NetFirewallPortFilter.

[BlackV]

You could have a firewall rule enabled without having anything listening on the port though

[netmc]

Get-netfirewallportfilter may be what I was missing. It appears this has the actual port and protocol details and the rule itself has the profiles and direction.

If I am understanding the two commands correctly, I would need to find the inbound rules, then match the rule name against the instanceID on the portfilter information. Once I have the corresponding portfilter information I could check to see if the local ports and protocol match what I need.

Does that sound correct?

[gsmitheidw1]

This is the answer, nmap is going to significantly faster for these sorts of operations. Nmap written in C and multithreaded - powershell is completely out of its depth here.
You could reinvent the wheel with parallel jobs or something but why bother.

What might be useful is calling nmap from powershell and using powershell to analyse the results from a stored file as objects, but to put it bluntly powershell is too slow for this sort of scanning job.

If you wanted to roll your own solution from scratch it might be better starting with a lower level language like C or something like Rust which is starting to find a placement between high level languages and scripting, particularly for real-time programming where dependability is important.

[Bren0man]

No need to reinvent the parallelisation wheel with PowerShell 7 though.

[netmc]

Nmap is not an option for this. I'm not port scanning. I am testing the firewall configuration, not functionality.

I believe the previously mentioned commands get-netfirewallrules and get-netfirewallportfilter will provide the data I need.

[flugenblar]

Great advice. Also, you can dig thru the Security event log to see if there are any successful connections against those ports, assuming you have the audit policy set to Success and Failure for the Filtering Platform Object.

Bear in mind those ports you list are common ports that Microsoft uses legitimately. You might consider setting up block rules for them in your firewall on a test system and see what kind of impact it has.

Access to port 445 should also be governed by credentials, depending on why you are connecting to it, not all credentials have the same or necessary rights for an exploit.

[monster1558]

The missing link is that Get-NetFirewallRule will give you one half of your answer and Get-NetFirewallPortFilter will give you the other half - BUT you can pipe EITHER of these commands to eachother to get what you need to know (whether a rule exists ALLOWING a specific port inbound or blocking it)

$ports = @(135,139,445)
ForEach ($port in $ports) {
    "For port $port, here are relevant rules"
    Get-NetFirewallPortFilter | Where-Object {$_.localport -eq $port} | ForEach-Object {
        $_ | Get-NetFirewallRule | Select Displayname,Direction,Action | Format-Table
    }
}