how to create a anonymous smb server without domain admin authority about cve-2021-1675

[cube0x0]

Local admin works https://github.com/cube0x0/CVE-2021-1675#smb-configuration

PS C:\Users\Administrator\Desktop> mkdir C:\share
Directory: C:
Mode LastWriteTime Length Name

---

d----- 6/30/2021 4:23 PM share

PS C:\Users\Administrator\Desktop> icacls C:\share\ /T /grant Anonymous` logon:r
processed file: C:\share
Successfully processed 1 files; Failed processing 0 files

PS C:\Users\Administrator\Desktop> icacls C:\share\ /T /grant Everyone:r
processed file: C:\share
Successfully processed 1 files; Failed processing 0 files

PS C:\Users\Administrator\Desktop> New-SmbShare -Path C:\share -Name share -ReadAccess 'ANONYMOUS LOGON','Everyone'
Name ScopeName Path Description

---

share * C:\share

PS C:\Users\Administrator\Desktop> REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionPipes /t REG_MULTI_SZ /d srvsvc /f #This will overwrite existing NullSessionPipes
The operation completed successfully.

PS C:\Users\Administrator\Desktop> REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionShares /t REG_MULTI_SZ /d share /f
The operation completed successfully.

PS C:\Users\Administrator\Desktop> REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v EveryoneIncludesAnonymous /t REG_DWORD /d 1 /f
The operation completed successfully.

PS C:\Users\Administrator\Desktop> REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymous /t REG_DWORD /d 0 /f
The operation completed successfully.

PS C:\Users\Administrator\Desktop> whoami
srv02\administrator

[MortalAndTry]

srv02\administrator is a domain administrator, so when you open a powershell with adminnistrator , it will require domain administrator authentication