Microsoft Windows SMB Registry : Autologon Password Exposed

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if (description)
{
 script_id(367860);
 script_version("1.1");
 script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

 script_name(english:"Microsoft Windows SMB Registry : Autologon Password Exposed");
 script_summary(english:"Determines if the autologon password is exposed");

 script_set_attribute(attribute:"synopsis", value:"Autologon Password Exposed");
 script_set_attribute(attribute:"description", value:
"This script determines whether the autologon feature exposes a password");
 script_set_attribute(attribute:"solution", value:
"Delete the keys AutoAdminLogon and DefaultPassword under
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon");
 script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
 script_set_attribute(attribute:"cvss_score_source", value:"manual");
 script_set_attribute(attribute:"cvss_score_rationale", value:"Score based on analysis of the vendor advisory");
 script_set_attribute(attribute:"see_also", value:"http://support.microsoft.com/kb/315231");

 script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

 script_set_attribute(attribute:"plugin_type", value:"local");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
 script_family(english:"Windows");
 script_dependencies("netbios_name_get.nasl", "smb_login.nasl", "smb_registry_access.nasl", "os_fingerprint.nasl", "smb_reg_autologon.nasl");
 script_require_keys("SMB/transport", "SMB/name", "SMB/login", "SMB/password", "SMB/registry_access", "Host/Autologon_exposure");
 script_require_ports(139, 445);
 exit(0);
}

include("structured_data_credential_exposure.inc");

var exposure, identity;
var exposed = get_kb_item_or_exit('Host/Autologon_exposure');

if (!empty_or_null(exposed))
{
  exposed = deserialize(exposed);

  exposure = {
    "source": "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword",
    "source_type": "REGISTRY",
    "credential_type": "AUTOLOGON"
  };

  identity = {};
  
  if (!empty_or_null(exposed[0]))
    identity['username'] = exposed[0];
  if (!empty_or_null(exposed[1]))
    identity['domain'] = exposed[1];

  if (!empty_or_null(identity))
    exposure['associated_identity'] = identity;
  
  structured_data_credential_exposure.append("exposures", exposure);
  structured_data_credential_exposure.report_internal();

  exit(0);
}