zeroscan

Zeroscan은 DC(도메인 컨트롤러) 취약점 스캐너로, 현재 Zerologon(CVE-2020-1472), MS-PAR/MS-RPRN 및 SMBv2 서명(Signing)에 대한 점검을 포함합니다.

CVE-2020-1472:

내장 스크립트를 사용하여 Zerologon(CVE-2020-1472)을 점검하지만, 대상을 공격(exploit)하지는 않습니다. 단순한 취약점 스캐너입니다. 코드베이스 출처: https://github.com/Anonymous-Family/CVE-2020-1472.git

MS-PAR / MS-RPRN:

Impacket의 rpcdump 래퍼를 사용하여 인쇄 서비스 MS-PAR 및 MS-RPRN에 원격으로 접근 가능한지 확인합니다. 이 점검은 대상이 CVE-2021-1675에 취약한지 판단하는 데 도움이 될 수 있습니다.

SMBv2 서명(Signing):

Nmap Scripting Engine(NSE) 스크립트 'smb2-security-mode'의 래퍼를 사용하여 대상의 SMBv2 서명 구성을 식별합니다.

설치(Installation):

git clone https://github.com/Anonymous-Family/Zero-day-scanning.git
cd Zero-day-scanning/
virtualenv -p /usr/bin/python3.9 venv
source venv/bin/activate
python3 -m pip install -r requirements.txt

메뉴(Menu):

Zeroscan
--------------------------------------------------

Usage:
  python3 zeroscan.py -t dc01 192.168.1.10
  python3 zeroscan.py -iL /path/to/targetfile.txt
  python3 zeroscan.py -iL /path/to/targetfile.txt --database
  python3 zeroscan.py -iL /path/to/targetfile.txt --drop-table
  python3 zeroscan.py -iL /path/to/targetfile.txt -r
  python3 zeroscan.py -iL /path/to/targetfile.txt -v


Primary options:
  -t TARGET TARGET     Single target using netbiosname and ipaddress. I.e "dc01 192.168.1.10"
  -iL TARGETSFILE      File that contains one target per line using netbiosname and ipaddress. I.e "dc01 192.168.1.10"

Secondary options:
  --database DATABASE  Filepath for database file.
  --drop-table         Drops database table.
  -r, --rpc-message    Turn on RPC response messages for CVE-2020-1472, helpful when troubleshooting connectivity issues.
  -v, --verbose        Turn on verbosity, helpful when debugging code.
  -h, --help           Show this help message and exit.

샘플 출력(Sample Output):

╔════════════════════════════════════════════════════════ ZEROSCAN ═════════════════════════════════════════════════════════╗
╚═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
Impacket v0.9.23

./zeroscan.py -iL targets.txt
CVE-2020-1472
DC01 192.168.160.134  - AUTH-ATTEMPTS: 26
DC02 192.168.160.133  - AUTH-ATTEMPTS: 1
DC03 192.168.160.137  - AUTH-ATTEMPTS: 2000


Impacket v0.9.23

rpcdump.py @ipaddress
MS-PAR/MS-RPRN
DC01 192.168.160.134 - MS-PAR: False, MS-RPRN: False
DC02 192.168.160.133 - MS-PAR: False, MS-RPRN: False
DC03 192.168.160.137 - MS-PAR: True, MS-RPRN: True


Nmap 7.91

nmap -Pn --script smb2-security-mode -p 445 -iL ./outputfiles/targets.txt -oX ./outputfiles/xml/smb2-security-mode.xml
SMB2-SECURITY-MODE
192.168.160.134 - MESSAGE SIGNING ENABLED BUT NOT REQUIRED
192.168.160.137 - MESSAGE SIGNING ENABLED AND REQUIRED


                                              Zeroscan Database
╔══════════╤═════════════════╤════════════════╤════════╤═════════╤══════════════════════════════════════════╗
║ Hostname │ IP Address      │ CVE_2020_1472  │ MS_PAR │ MS_RPRN │ SMBv2_Signing                            ║
╟──────────┼─────────────────┼────────────────┼────────┼─────────┼──────────────────────────────────────────╢
║ DC01     │ 192.168.160.134 │ VULNERABLE     │ False  │ False   │ Message signing enabled but not required ║
║ DC02     │ 192.168.160.133 │ NA             │ False  │ False   │ NA                                       ║
║ DC03     │ 192.168.160.137 │ NOT VULNERABLE │ True   │ True    │ Message signing enabled and required     ║
╚══════════╧═════════════════╧════════════════╧════════╧═════════╧══════════════════════════════════════════╝

데모 - 다중 대상(Multi-target):

Zeroscan Demo

Zero-day-scanning

인기

zeroscan