How to remediate – Windows FTP Server NULL Administrator Password

1. Introduction

The Windows FTP Server NULL Administrator Password vulnerability allows an attacker to gain unauthorised access to a remote system running an FTP server. This is because the ‘Administrator’ account has no password set, allowing anyone to log in. Successful exploitation can lead to arbitrary file reading, writing and deletion on the affected host, impacting confidentiality, integrity, and availability of data. Systems commonly affected are Windows servers with the FTP service enabled.

2. Technical Explanation

The vulnerability occurs when the FTP server is configured with a blank password for the ‘Administrator’ user account. This allows remote attackers to authenticate without needing valid credentials. An attacker can then access files and perform actions as if they were an administrator on the system. There is no known CVE associated with this specific configuration issue, but it represents a critical misconfiguration.

• Root cause: The FTP service permits login with a NULL password for the ‘Administrator’ account.
• Exploit mechanism: An attacker connects to the FTP server and attempts to log in using the username ‘Administrator’ and an empty password string. If successful, they gain access to the file system. For example, using a standard FTP client like FileZilla or command-line FTP tools.
• Scope: Windows servers running FTP service with default or incorrectly configured accounts. Affected versions are those where the FTP service is enabled and improperly secured.

3. Detection and Assessment

You can confirm a vulnerable system by checking the FTP server configuration and attempting to log in as ‘Administrator’ without a password. A thorough method involves reviewing user account settings.

• Quick checks: Use the `net user Administrator` command in Command Prompt. If it shows no password set, the system is likely vulnerable.
• Scanning: Nessus plugin ID 10429 can detect this issue as an example. Other vulnerability scanners may also have similar checks.
• Logs and evidence: Check Windows Event Logs for successful login events from ‘Administrator’ without a password. Look in the Security log for event ID 4624 with account name ‘Administrator’.

net user Administrator

4. Solution / Remediation Steps

To fix this issue, change the password on the ‘Administrator’ account immediately. Follow these steps to ensure a secure configuration.

4.1 Preparation

• Ensure you have an alternative administrator account with a strong password for access in case of issues. Roll back by restoring the snapshot or backup if needed.
• A standard change window may be required, and approval from IT security is recommended.

4.2 Implementation

1. Step 1: Open Command Prompt as an administrator.
2. Step 2: Run the command `net user Administrator *` to prompt for a new password.
3. Step 3: Enter and confirm a strong, unique password for the ‘Administrator’ account.
4. Step 4: Restart the FTP service if it was stopped earlier.

4.3 Config or Code Example

Before

net user Administrator

After

net user Administrator * 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege reduces the impact if an account is compromised, and strong password policies enforce secure credentials.

• Practice 1: Implement least privilege by granting users only the necessary permissions.
• Practice 2: Enforce strong password policies that require complex passwords and regular changes.

4.5 Automation (Optional)

A PowerShell script can be used to change the Administrator password on multiple systems, but exercise caution when automating password changes.

# Example PowerShell Script - Use with Caution!
$servers = @("server1", "server2") # Replace with your server names
foreach ($server in $servers) {
  Invoke-Command -ComputerName $server -ScriptBlock {
    net user Administrator *
  }
}

5. Verification / Validation

• Post-fix check: Run `net user Administrator` again. It should show a password has been set.
• Re-test: Attempt to connect to the FTP server using an FTP client with ‘Administrator’ and no password. The connection should fail.
• Smoke test: Verify that other administrator accounts can still log in successfully.
• Monitoring: Monitor Windows Event Logs for failed login attempts from ‘Administrator’. A spike in failures could indicate ongoing attacks.

net user Administrator

6. Preventive Measures and Monitoring

Regular security baselines and patch management processes can help prevent this issue. Consider adding checks to your CI/CD pipelines.

• Baselines: Update a Windows security baseline or Group Policy Object (GPO) to enforce strong password requirements for all accounts, including ‘Administrator’.
• Pipelines: Add static analysis tools to your CI/CD pipeline to detect default credentials and insecure configurations.
• Asset and patch process: Implement a regular patch review cycle and configuration audit schedule.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Applications using the ‘Administrator’ account may require updates with the new credentials.
• Risk or side effect 2: Incorrectly configured applications could be affected by the password change.

8. References and Resources

• Vendor advisory or bulletin: Microsoft FTP Security Best Practices
• NVD or CVE entry: This configuration issue does not have a specific CVE, but is covered in general security guidance.
• Product or platform documentation relevant to the fix: Net User Documentation