Microsoft Telnet Server NTLM Mutual Authentication Configuration Issue

Author: hackerhouse-opensource

MsTelnetServer_NTLM_MutualAuth_ConfigIssue.txt

@@ -9,18 +9,18 @@ Status: Unpatched, non-exploitable.
 
 Summary
 =======
-The Microsoft Telnet Server’s NTLM authentication over MS-TNAP uses
-SECPKG_CRED_BOTH in AcquireCredentialsHandle and ASC_REQ_MUTUAL_AUTH/ASC_REQ_DELEGATE in 
-AcceptSecurityContext. These settings suggest a potential vulnerability where an attacker 
-could invert authentication, forcing the server to authenticate to the client. Testing 
-with a modified telnet client (telnet_token.exe, based on updated netio.c and security.c) 
-alongside auditing of the server behaviors has confirmed the issue is not exploitable. The 
-server never initiates authentication with an NTLM Type 1 message, rendering these flags
-ineffective for exploitation uses by the client. Administrators should disable
-Telnet due to its plaintext transmission, but no specific action is required for
-this issue. The server implementation should, however, explicitly specify
-SECPKG_CRED_INBOUND and not support ASC_REQ_MUTUAL and ASC_REQ_DELEGATE if mutual
-authentication is not required.
+The Microsoft Telnet Server’s NTLM authentication over MS-TNAP specifies 
+AUTH_SERVER_TO_CLIENT and AUTH_HOW_MUTUAL flags in the protocol but does not 
+implement them in server logic. It also uses SECPKG_CRED_BOTH in AcquireCredentialsHandle
+and ASC_REQ_MUTUAL_AUTH/ASC_REQ_DELEGATE in AcceptSecurityContext, suggesting a 
+potential vulnerability where an attacker could invert authentication, forcing the 
+server to authenticate to the client. Testing with a modified PoC tool (telnet_token.exe,
+based on updated netio.c and security.c) and auditing server behavior confirmed the issue
+is not exploitable. The server never initiates authentication with an NTLM Type 1 message, 
+rendering these flags ineffective for client exploitation. Administrators should disable 
+Telnet due to its plaintext transmission, but no specific action is required for this issue. 
+The server should explicitly use SECPKG_CRED_INBOUND and avoid supporting ASC_REQ_MUTUAL 
+and ASC_REQ_DELEGATE if mutual authentication is not needed.
 
 Technical Details
 =================