{"id":27,"title":"LAN Manager Authentication (Misconfiguration)","content":"

 <\/p>\n

Kimlik Do\u011frulama Protokolü Güvenli\u011fi<\/h1>\n

LAN Manager Authentication Level Güvenlik Aç\u0131\u011f\u0131<\/h2>\n

Windows a\u011f ortamlar\u0131nda kimlik do\u011frulama güvenli\u011fi<\/strong>, sistem bütünlü\u011fünün en kritik unsurlar\u0131ndan biridir. LAN Manager Authentication Level<\/strong> ayar\u0131n\u0131n güvenli seviyeye ayarlanmamas\u0131, sald\u0131rganlar\u0131n eski ve zay\u0131f kimlik do\u011frulama protokollerini<\/strong> kullanarak sisteme s\u0131zmas\u0131na olanak tan\u0131r.<\/p>\n

Bu yaz\u0131da, bu kritik güvenlik aç\u0131\u011f\u0131n\u0131<\/strong> ve etkili çözüm yöntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n

\n

LAN Manager Authentication Level Nedir?<\/h2>\n

LAN Manager Authentication Level<\/strong>, Windows sistemlerinin hangi kimlik do\u011frulama protokollerini kabul edece\u011fini<\/strong> belirleyen kritik bir güvenlik ayar\u0131d\u0131r. Bu ayar, a\u011f kaynaklar\u0131na eri\u015fim s\u0131ras\u0131nda kullan\u0131lacak kimlik do\u011frulama yöntemini<\/strong> kontrol eder.<\/p>\n

\n

Kimlik Do\u011frulama Protokolleri<\/h2>\n

Windows ortamlar\u0131nda üç temel kimlik do\u011frulama protokolü<\/strong> bulunur:<\/p>\n

\n

1. LM (LAN Manager) – En Zay\u0131f<\/h3>\n
    \n
  • \n

    Geli\u015ftirme Tarihi:<\/strong> 1980’ler<\/p>\n<\/li>\n

  • \n

    \u015eifre Uzunlu\u011fu:<\/strong> Maksimum 14 karakter<\/p>\n<\/li>\n

  • \n

    \u015eifreleme:<\/strong> DES tabanl\u0131, çok zay\u0131f<\/p>\n<\/li>\n

  • \n

    Güvenlik Riski:<\/strong> \u274c Çok yüksek<\/p>\n<\/li>\n<\/ul>\n

    \n

    2. NTLM (NT LAN Manager) – Orta Seviye<\/h3>\n
      \n
    • \n

      Geli\u015ftirme Tarihi:<\/strong> 1990’lar<\/p>\n<\/li>\n

    • \n

      \u015eifre Uzunlu\u011fu:<\/strong> S\u0131n\u0131rs\u0131z<\/p>\n<\/li>\n

    • \n

      \u015eifreleme:<\/strong> MD4 tabanl\u0131<\/p>\n<\/li>\n

    • \n

      Güvenlik Riski:<\/strong> \u26a0\ufe0f Orta–Yüksek<\/p>\n<\/li>\n<\/ul>\n

      \n

      3. NTLMv2 (NT LAN Manager v2) – En Güvenli<\/h3>\n
        \n
      • \n

        Geli\u015ftirme Tarihi:<\/strong> 1998<\/p>\n<\/li>\n

      • \n

        \u015eifre Uzunlu\u011fu:<\/strong> S\u0131n\u0131rs\u0131z<\/p>\n<\/li>\n

      • \n

        \u015eifreleme:<\/strong> HMAC-MD5 tabanl\u0131<\/p>\n<\/li>\n

      • \n

        Güvenlik Riski:<\/strong> \u2705 Dü\u015fük (mevcut protokoller aras\u0131nda)<\/p>\n<\/li>\n<\/ul>\n

        \n

        Güvenlik Riskleri ve Sald\u0131r\u0131 Yöntemleri<\/h2>\n

        1. LM Protokolü Zafiyetleri<\/h3>\n

        Pass-the-Hash Sald\u0131r\u0131lar\u0131<\/h4>\n
          \n
        • \n

          LM hash de\u011ferleri kolayca ele geçirilebilir<\/p>\n<\/li>\n

        • \n

          Gerçek parolaya ihtiyaç duyulmaz<\/p>\n<\/li>\n

        • \n

          Lateral movement için kullan\u0131labilir<\/p>\n<\/li>\n<\/ul>\n

          Brute Force Sald\u0131r\u0131lar\u0131<\/h4>\n
            \n
          • \n

            14 karakter s\u0131n\u0131r\u0131 nedeniyle dü\u015fük karma\u015f\u0131kl\u0131k<\/p>\n<\/li>\n

          • \n

            DES \u015fifreleme modern sistemlerde h\u0131zl\u0131 k\u0131r\u0131l\u0131r<\/p>\n<\/li>\n

          • \n

            Rainbow table sald\u0131r\u0131lar\u0131 oldukça etkilidir<\/p>\n<\/li>\n<\/ul>\n

            \n

            2. NTLM Protokolü Zafiyetleri<\/h3>\n

            Replay Sald\u0131r\u0131lar\u0131<\/h4>\n
              \n
            • \n

              Kimlik do\u011frulama paketleri yakalan\u0131p tekrar kullan\u0131labilir<\/p>\n<\/li>\n

            • \n

              Zaman damgas\u0131 korumas\u0131 zay\u0131ft\u0131r<\/p>\n<\/li>\n

            • \n

              Challenge-response mekanizmas\u0131 bypass edilebilir<\/p>\n<\/li>\n<\/ul>\n

              Relay Sald\u0131r\u0131lar\u0131<\/h4>\n
                \n
              • \n

                NTLM trafi\u011fi ba\u015fka sistemlere yönlendirilebilir<\/p>\n<\/li>\n

              • \n

                SMB relay sald\u0131r\u0131lar\u0131 gerçekle\u015ftirilebilir<\/p>\n<\/li>\n

              • \n

                Sald\u0131rgan kendisini hedef sistem gibi gösterebilir<\/p>\n<\/li>\n<\/ul>\n

                \n

                3. NTLMv2 Avantajlar\u0131<\/h3>\n

                Güçlü \u015eifreleme<\/h4>\n
                  \n
                • \n

                  HMAC-MD5 tabanl\u0131 geli\u015fmi\u015f \u015fifreleme<\/p>\n<\/li>\n

                • \n

                  Mutual authentication deste\u011fi<\/p>\n<\/li>\n

                • \n

                  Replay sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma<\/p>\n<\/li>\n<\/ul>\n

                  Geli\u015fmi\u015f Challenge-Response<\/h4>\n
                    \n
                  • \n

                    Güçlü nonce de\u011ferleri<\/p>\n<\/li>\n

                  • \n

                    Zaman damgas\u0131 do\u011frulamas\u0131<\/p>\n<\/li>\n

                  • \n

                    Replay ve relay sald\u0131r\u0131lar\u0131na kar\u015f\u0131 direnç<\/p>\n<\/li>\n<\/ul>\n

                    \n

                    Çözüm Yöntemleri<\/h2>\n

                    1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n

                    Ad\u0131m 1:<\/strong> Group Policy Management Console<\/p>\n

                    gpmc.msc\n<\/code><\/pre>\n
                    Ad\u0131m 2:<\/strong> Politika Düzenleme<\/p>\n
                    Computer Configuration\n→ Windows Settings\n→ Security Settings\n→ Local Policies\n→ Security Options\n<\/code><\/pre>\n
                    Ad\u0131m 3:<\/strong>
                    “Network security: LAN Manager authentication level”<\/strong> politikas\u0131n\u0131 bulun.<\/p>\n
                    Güvenli Ayar:<\/strong><\/p>\n
                    Send NTLMv2 response only. Refuse LM & NTLM\n<\/code><\/pre>\n
                    \n
                    2. Registry Üzerinden Yap\u0131land\u0131rma<\/h3>\n
                    Registry Anahtar\u0131:<\/strong><\/p>\n
                    HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n<\/code><\/pre>\n
                    De\u011ferler:<\/strong><\/p>\n
                      \n
                    • \n
                      De\u011fer Ad\u0131:<\/strong> LmCompatibilityLevel<\/p>\n<\/li>\n
                    • \n
                      Tür:<\/strong> REG_DWORD<\/p>\n<\/li>\n
                    • \n
                      Önerilen De\u011fer:<\/strong> 5<\/p>\n<\/li>\n<\/ul>\n
                      PowerShell ile Uygulama:<\/strong><\/p>\n
                      Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n -Name \"LmCompatibilityLevel\" -Value 5\n<\/code><\/pre>\n
                      \n
                      3. Güvenlik Seviyeleri Tablosu<\/h3>\n\n\n\n\n\n\n\n\n\n\n
                      Seviye<\/th>\nAç\u0131klama<\/th>\nGüvenlik<\/th>\n<\/tr>\n<\/thead>\n
                      0<\/td>\nLM ve NTLM gönder<\/td>\n\u274c Çok güvensiz<\/td>\n<\/tr>\n
                      1<\/td>\nLM & NTLM gönder, NTLMv2 kullan<\/td>\n\u274c Güvensiz<\/td>\n<\/tr>\n
                      2<\/td>\nSadece NTLM gönder<\/td>\n\u26a0\ufe0f Orta risk<\/td>\n<\/tr>\n
                      3<\/td>\nSadece NTLMv2 gönder<\/td>\n\u26a0\ufe0f Orta risk<\/td>\n<\/tr>\n
                      4<\/td>\nNTLMv2 gönder, LM reddet<\/td>\n\u2705 Güvenli<\/td>\n<\/tr>\n
                      5<\/td>\nNTLMv2 gönder, LM & NTLM reddet<\/td>\n\u2705 En güvenli<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                      \n
                      Domain Controller Ayarlar\u0131<\/h2>\n
                      DC için Minimum Güvenli Seviye<\/h3>\n
                      Network security: LAN Manager authentication level = 4\n<\/code><\/pre>\n
                      Ek Güvenlik Ayarlar\u0131<\/h3>\n
                        \n
                      • \n
                        Do not store LAN Manager hash value on next password change<\/strong> → Enabled<\/p>\n<\/li>\n
                      • \n
                        Network security: Do not store LAN Manager hash value on next password change<\/strong> → Enabled<\/p>\n<\/li>\n<\/ul>\n
                        \n
                        Active Directory Functional Level<\/h2>\n
                        NTLMv2 zorunlulu\u011fu için:<\/p>\n
                          \n
                        • \n
                          Domain Functional Level:<\/strong> En az Windows 2000 Native<\/p>\n<\/li>\n
                        • \n
                          Forest Functional Level:<\/strong> En az Windows 2000<\/p>\n<\/li>\n<\/ul>\n
                          \n
                          Deployment Sonras\u0131 Dikkat Edilmesi Gerekenler<\/h2>\n
                          1. Legacy Sistem Uyumlulu\u011fu<\/h3>\n
                          Etkilenebilecek Sistemler:<\/strong><\/p>\n
                            \n
                          • \n
                            Windows 95 \/ 98 \/ ME<\/p>\n<\/li>\n
                          • \n
                            Windows NT 4.0 (SP4 öncesi)<\/p>\n<\/li>\n
                          • \n
                            Samba 3.0 öncesi Linux sistemler<\/p>\n<\/li>\n
                          • \n
                            Yaz\u0131c\u0131lar, NAS cihazlar\u0131, gömülü sistemler<\/p>\n<\/li>\n<\/ul>\n
                            Çözüm Stratejileri:<\/strong><\/p>\n
                              \n
                            • \n
                              Sistem envanteri ç\u0131kar\u0131n<\/p>\n<\/li>\n
                            • \n
                              Test ortam\u0131nda uygulay\u0131n<\/p>\n<\/li>\n
                            • \n
                              Kimlik do\u011frulama hatalar\u0131n\u0131 izleyin<\/p>\n<\/li>\n
                            • \n
                              Legacy sistemler için upgrade plan\u0131 yap\u0131n<\/p>\n<\/li>\n<\/ul>\n
                              \n
                              2. Uygulama Uyumlulu\u011fu<\/h3>\n
                              Kontrol edilmesi gerekenler:<\/p>\n
                                \n
                              • \n
                                Third-party uygulamalar<\/p>\n<\/li>\n
                              • \n
                                Veritaban\u0131 ba\u011flant\u0131lar\u0131<\/p>\n<\/li>\n
                              • \n
                                Web uygulamalar\u0131<\/p>\n<\/li>\n
                              • \n
                                Yedekleme yaz\u0131l\u0131mlar\u0131<\/p>\n<\/li>\n<\/ul>\n
                                \n
                                3. Monitoring ve Logging<\/h3>\n
                                \u0130lgili Event ID’ler:<\/strong><\/p>\n
                                  \n
                                • \n
                                  4776:<\/strong> Credential validation attempted<\/p>\n<\/li>\n
                                • \n
                                  4625:<\/strong> Failed logon attempt<\/p>\n<\/li>\n
                                • \n
                                  4648:<\/strong> Explicit credentials<\/p>\n<\/li>\n<\/ul>\n
                                  PowerShell Monitoring:<\/strong><\/p>\n
                                  Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4776} |\n Where-Object {$_.Message -like \"*LM*\" -or $_.Message -like \"*NTLM*\"}\n<\/code><\/pre>\n
                                  \n
                                  Güvenlik Do\u011frulama<\/h2>\n
                                  1. Mevcut Ayarlar\u0131n Kontrolü<\/h3>\n
                                  GPO ile:<\/strong><\/p>\n
                                  gpresult \/h gpreport.html\n<\/code><\/pre>\n
                                  Registry ile:<\/strong><\/p>\n
                                  Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n -Name \"LmCompatibilityLevel\"\n<\/code><\/pre>\n
                                  \n
                                  2. A\u011f Trafi\u011fi Analizi<\/h3>\n
                                    \n
                                  • \n
                                    Wireshark ile NTLM paketlerini yakalay\u0131n<\/p>\n<\/li>\n
                                  • \n
                                    Protokol sürümünü do\u011frulay\u0131n<\/p>\n<\/li>\n
                                  • \n
                                    Challenge-response mekanizmas\u0131n\u0131 inceleyin<\/p>\n<\/li>\n<\/ul>\n
                                    \n
                                    3. Güvenlik Tarama<\/h3>\n
                                    Nmap ile:<\/strong><\/p>\n
                                    nmap --script smb-security-mode\n<\/code><\/pre>\n
                                    PowerShell Bulk Kontrol:<\/strong><\/p>\n
                                    $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name\nforeach ($computer in $computers) {\n  try {\n    $lmLevel = Invoke-Command -ComputerName $computer -ScriptBlock {\n      Get-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" `\n       -Name \"LmCompatibilityLevel\"\n    }\n    Write-Output \"$computer : $($lmLevel.LmCompatibilityLevel)\"\n  } catch {\n    Write-Output \"$computer : Connection failed\"\n  }\n}\n<\/code><\/pre>\n
                                    \n
                                    Sonuç ve Öneriler<\/h2>\n
                                    LAN Manager Authentication Level<\/strong> ayar\u0131n\u0131n Seviye 5<\/strong> olarak yap\u0131land\u0131r\u0131lmas\u0131, Windows a\u011f güvenli\u011finin temel gereksinimlerinden biridir<\/strong>.<\/p>\n
                                    “Send NTLMv2 response only. Refuse LM & NTLM”<\/strong> yap\u0131land\u0131rmas\u0131, modern güvenlik standartlar\u0131na uygun minimum güvenli seviye<\/strong> olarak kabul edilir.<\/p>\n
                                    \n
                                    H\u0131zl\u0131 Uygulama Ad\u0131mlar\u0131<\/h3>\n
                                    \u2705 Mevcut durumu analiz edin
                                    \u2705 Test ortam\u0131nda uygulay\u0131n
                                    \u2705 Legacy sistemleri tespit edin
                                    \u2705 GPO ile seviye 5’e ayarlay\u0131n
                                    \u2705 Monitoring sistemini kurun
                                    \u2705 A\u015famal\u0131 deployment gerçekle\u015ftirin<\/p>\n
                                    \n
                                    Kritik Kontrol Listesi<\/h3>\n
                                    \u2705 LmCompatibilityLevel = 5<\/code> mi?
                                    \u2705 Domain GPO’da politika aktif mi?
                                    \u2705 Legacy sistemler güncellendi mi?
                                    \u2705 Monitoring aktif mi?
                                    \u2705 Incident response plan\u0131 haz\u0131r m\u0131?<\/p>\n
                                    \n
                                    Bu yap\u0131land\u0131rmay\u0131 uygulayarak pass-the-hash<\/strong>, replay<\/strong> ve relay<\/strong> sald\u0131r\u0131lar\u0131na kar\u015f\u0131 sisteminizi önemli ölçüde koruyabilir ve modern kimlik do\u011frulama standartlar\u0131na uygun<\/strong> bir güvenlik seviyesi sa\u011flayabilirsiniz.<\/p>","excerpt":"Windows a\u011f ortamlar\u0131nda kimlik do\u011frulama g\u00fcvenli\u011fi, sistem b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fcn en kritik unsurlar\u0131ndan biridir. LAN Manager Authentication Level ayar\u0131n\u0131n g\u00fcvenli seviyeye ayarlanmamas\u0131, sald\u0131rganlar\u0131n eski ve zay\u0131f kimlik do\u011frulama protokollerini kullanarak sisteme s\u0131zmas\u0131na olanak tan\u0131r.","created_at":"2025-07-16 23:49:29","updated_at":"2026-09-23 15:28:56","category_id":12,"view_count":643,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:49:29","featured_image":"\/uploads\/images\/2025\/12\/6947c5a1a2465_1766311329.png","slug":"lan-manager-authentication-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"}