Attack Tools Collection

Here is a list of attacking tools collected recently.

AutoDeAuth - A tool built to automatically deauth local networks.

Aced - A tool to parse and resolve a single targeted Active Directory principal's DACL. will identify interesting inbound access allowed privileges against the targeted account, resolve the SIDS of the inbound permissions, and present that data to the operator. Additionally, the logging features of pyldapsearch have been integrated with Aced to log the targeted principal's LDAP attributes locally which can then be parsed by pyldapsearch's companion tool BOFHound to ingest the collected data into BloodHound.

Aura - A Python Source Code Auditing And Static Analysis On A Large Scale. It is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI.

Coercer - A Python Script To Automatically Coerce A Windows Server To Authenticate On An Arbitrary Machine Through 9 Methods.

GraphCrawler - GraphQL Automated Security Testing Toolkit. It is the most powerful automated testing toolkit for any GraphQL endpoint. (Req: Python3, Docker Python dependencies)

pycvss3 - Python API for the CVSS v3.

noPac Vulnerabilty for DC

Finally noPac exploit is confirmed and released. As mentioned in last month post, these 2 vulnerabilities (cve-2021-42278 and cve-2021-42287) effectively allow a regular domain user to take control of a domain controller. This is a serious concern as the exploit was confirmed as a low-effort exploit with critical impact.

Gaining domain privileges allows threat actors to gain control over a domain and use it as a starting point to deploy malware, including ransomware.

Immediate Actions:

Make sure all the domain controllers (DC) are patched and make no exception. The whole domain remains vulnerable even with one DC remain not patched successfully. The patch is available since Nov 2021.

Also do start with any detection and apply mitigation in my previous post.

Links:

• noPac Exploit: Latest Microsoft AD Flaw May Lead to Total Domain Compromise in Seconds
• https://github.com/Ridter/noPac
• noPac: A Tale of Two Vulnerabilities That Could End in Ransomware
• Weaponise Exploits for samAccountName Spoofing (CVE-2021–42278) & Domain Controller Impersonation (CVE-2021–42287)
  

Weaponise Exploits for samAccountName Spoofing (CVE-2021–42278) & Domain Controller Impersonation (CVE-2021–42287)

Exploit to impersonate from regular domain user released!

Microsoft released patches to address two (2) vulnerabilities that affect Windows Active Directory domain controllers: samAccountName Spoofing and Domain Controller Impersonation in November 2021. 

Both vulnerabilities, samAccountName Spoofing (CVE-2021–42278) & Domain Controller Impersonation (CVE-2021–42287), allow an adversary with access to low-privileged domain user credentials, to obtain a Kerberos Service Ticket for Domain Controller computer account. This will effectively allows a regular domain user to take control of a domain controller.

Mitigation / Detection

It is recommended to install the Microsoft patch (KB5008602) to mitigate against this attack. This patch fixes the issue with PAC confusion and S4U2self created earlier.

Another way is, setting the Machine Account Quota to 0 is also a quick fix for stopping low privileged user from being able to create machine accounts. Other than that, removing Authenticated Users from SeMachineAccountPrivilege and adding Domain Admins or another group of allowed accounts.

Links:

• Hunting for samAccountName Spoofing (CVE-2021–42278) & Domain Controller Impersonation (CVE-2021–42287)
• CVE-2021-42287/CVE-2021-42278 Weaponisation 
• https://github.com/WazeHell/sam-the-admin
  

Another Update on PrintNightmare

After the PrintNightmare update, I managed to find more details about how to remediate CVE-2021-34527 correctly.

How PrintNightmare works?

By sending a request to add a printer, e.g. by using RpcAddPrinterDriverEx() over SMB or RpcAsyncAddPrinterDriver() over RPC, a remote, authenticated attacker may be able to execute arbitrary code with SYSTEM privileges on a vulnerable system. A local unprivileged user may be able to execute arbitrary code with SYSTEM privileges as well.

Apply an update

Microsoft has addressed this issue in the updates for CVE-2021-34527. Note that the Microsoft update for CVE-2021-34527 does not effectively prevent exploitation of systems where the Point and Print NoWarningNoElevationOnInstall is set to a non-0 value. Microsoft indicates that systems that have NoWarningNoElevationOnInstall is set to a non-0 value are vulnerable by design. 

Workaround

For systems that do not have the CVE-2021-34527 installed, or have Point and Print configured insecurely, please consider the following workarounds:

1. Stop and disable the Print Spooler service
2. Disable inbound remote printing through Group Policy (Print Spooler service must be restarted)
   
3. Block RPC and SMB ports at the firewall
4. Enable security prompts for Point and Print
• HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\
• NoWarningNoElevationOnInstall = 0
• UpdatePromptSettings = 0
5. Restrict printer driver installation ability to administrators.
   

Links:

• https://www.kb.cert.org/vuls/id/383432
  
• https://docs.microsoft.com/en-us/windows-hardware/drivers/print/introduction-to-point-and-print
  

Update on the Printer Spooler Vulnerability

Malware attack and successful exploitation are found for the cve-2021-1675. It can be  easily exploited and become a popular target with daily trend of going UP.

Initially, this vulnerability was categorized as LPE (Local Privileges Escalation), and been changed to RCE (Remote Code Execution) later (June 21).

Here's the latest vulnerability intelligence from KennaVI+.

[ CVE Description ]
 [*] CVE_ID : CVE-2021-1675
 [_] Desc   : Windows Print Spooler Elevation of Privilege Vulnerability

[ Kenna.VM Summary ]
 [*] Vuln Risk              : 77.227
 [*] Easily_Exploit         : True
 [*] Malware_Exploit        : True
 [*] Popular_Target         : True
 [*] Active_Internet_Breach : True

[ Kenna.VI+ ]
 [*] Successful_Exploitations  : 3
 [*] Velocity (D/W/M)          : 2/3/3
 [*] Daily_Trend               : up
 [*] Pre_NVD                   : True [_FALSE_]
 [*] RCE                       : True [_FALSE_]
 [*] Predicted_Exploitable     : 3 (0.2499% confidence)

[ Kenna.VI+ Details ]
 [_] Created_at    : 2020-12-02T22:00:10Z
 [_] Published     : 2021-06-08T23:15:00Z
 [_] Last_Modified : 2021-06-10T23:21:00Z

[ Links / References ]
 [*] Malware sample : 1
 [_] Exploits [2]:
     [ --> ]   created_at : 2021-06-30T14:00:00Z
     [ --> ]  external_id : kenna.CVE-2021-1675
     [ --> ]         name : CVE-2021-1675: PrintNightmare
     [ --> ]       source : kenna
     [ --> ]          url : https://github.com/afwu/PrintNightmare

     [ --> ]   created_at : 2021-07-01T07:00:29Z
     [ --> ]  external_id : None
     [ --> ]         name : Win64.Exploit.CVE-2021-1675
     [ --> ]       source : reversing_labs
     [ --> ]          url : None

 [_] Fixes [2]:
     [ --> ]  external_id : 91772
     [ --> ]          url : https://support.microsoft.com/en-in/help/5003635
     [ --> ]      product : windows
     [ --> ] published_at : 2021-06-09T01:30:40Z

     [ --> ]  external_id : msft-cve-2021-1675
     [ --> ]          url : None
     [ --> ]      product : None
     [ --> ] published_at : 2021-06-08T00:00:00Z

 [_] Threat Actors [0]:
     [ --> ] None

[ CVSS2 / CVSS3  Details ]

                | Impact  |   |                | CVSS_Access
================+=========+===+================+==============
   Availability | Partial |   |     Complexity | Medium
Confidentiality | Partial |   |         Vector | Network
      Integrity | Partial |   | Authentication | None required

              |                                   CVSS_V2 |                                                    CVSS_V3
==============+===========================================+===========================================================
   Base Score |                                     6.800 |                                                      7.800
Exploit_Score |                                     8.600 |                                                      1.800
 Impact_Score |                                     6.400 |                                                      5.900
     Temporal |                                     5.000 |                                                       None
       Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

[ Others ]
 [*] Vulnerable Products [4] :
     [ --> ] cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
     [ --> ] cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
     [ --> ] cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
     [ --> ] cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*


[ CVE Malware Family Info : None ]

[ CVE History : CVE-2021-1675 ]
 [*] ID              : 2658603
 [*] Vuln Risk Score : 77
 [*] History         : 4

   [**] changed_at : 2021-06-09T04:14:45.000Z
   [**]       from : 25
   [**]         to : 20

   [**] changed_at : 2021-06-10T04:26:09.000Z
   [**]       from : 20
   [**]         to : 22

   [**] changed_at : 2021-06-11T04:09:42.000Z
   [**]       from : 22
   [**]         to : 33

   [**] changed_at : 2021-07-01T04:15:49.000Z
   [**]       from : 33
   [**]         to : 77

[ High_Profile_Vulnerability ]
 [!!!]    CVE-2021-1675 (77.227) : ['hpv_exploit', 'hpv_malware', 'hpv_poc']


 ** [5] threads completed [3 tasks] / [2.39 KB] within [2.95 sec].

What You May Not Know about the SMB2 0Day

What you may already heard/known today about the SMBv2 0day:

• Remote code execution is released.
• The workaround from Microsoft.
• Why only Windows Vista, 2003, 2008 are vulnerable (including Window 7 RC), but not XP/2000.

Here's a list of follow up that you may not know yet:

• More than 10 version of the exploit is available here (C, PERL, Python, Ruby, win32)
• Port of the BSOD code to Metasploit (instead of RCE).
• Winsock edition is here.
• SMBv2 vulnerability scanner (class B, C) in Python.

In additional, rumor says:

• Could be the same old vulnerability back in 2007.
• Why Windows 7 RTM is not vulnerable:

"We found this issue independently through our fuzzing processes and implemented the fix into Windows 7 RTM (release to manufacturer) and Windows Server 2008 R2," the spokesperson says. "We're working to develop a security update for Windows Vista, Windows Server 2008 and Windows 7 RC."

SMB2 BSOD 0Day

The vulnerability was discovered by Laurent Gaffié. Here's the short description about the vulnerability:

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it’s used to identify the SMB dialect that will be used for futher communication.

Based on testing, Vista/2003/2008/Windows 7 (RC) are vulnerable to this exploit. However, Windows 2000/XP/Windows 7 (RTM) are NOT affected by this exploit.

References:

• SMB2 Negotiate Protocol Request Remote BSOD (python exploit code)
• SANS: SMB2 BSOD 0Day
• SANS:SMB2 Remote Exploit released.

Microsoft IIS 5/6 FTP 0Day released

A new 0-day exploit been released. It is targeting Win2K's Microsoft IIS 5/6 FTP service.

Your server is vulnerable if you are:

• Running Microsoft IIS 5/6 FTP service on Windows 2000.
• Allowing anonymous access with WRITE access.

References:

• SANS: Microsoft IIS 5/6 FTP 0Day released.
• Exploit at Milw0rm.

PDF Exploit PoC without any user interaction

Last week, Belgian security researcher Didier Stevens demonstrated that a PDF exploitation could be possible with the user only selecting the file (the answer lies in Windows Explorer Shell Extensions).

Now he took it even a level further: you can be vulnerable by just having an infected file. The problem lies with the Windows Indexing Service.

Here is still a list of possible countermeasures:

• Disable JavaScript in Adobe Acrobat Reader.
• An up-to-date anti-virus.
• Host-based IDS/IPS signatures.
• Disable automatic rendering of PDFs in the browser
• Use an alternative PDF reader like Foxit Reader or Sumatra PDF.
• Disable or deinstall windows indexing service.

Related posts:

• Quickpost: /JBIG2Decode “Look Mommy, No Hands!”
  
• Acrobat reader exploit works without opening pdf

Inside Uninformed Vol 10

Analyzing local privilege escalations in win32k

This paper analyzes three vulnerabilities that were found in win32k.sys that allow kernel-mode code execution. The win32k.sys driver is a major component of the GUI subsystem in the Windows operating system. These vulnerabilities have been reported by the author and patched in MS08-025.

The first vulnerability is a kernel pool overflow with an old communication mechanism called the Dynamic Data Exchange (DDE) protocol. The second vulnerability involves improper use of the ProbeForWrite function within string management functions. The third vulnerability concerns how win32k handles system menu functions. Their discovery and exploitation are covered.

Exploiting Tomorrow's Internet Today: Penetration Testing with IPv6

This paper illustrates how IPv6-enabled systems with link-local and auto-configured addresses can be compromised using existing security tools. While most of the techniques described can apply to "real" IPv6 networks, the focus of this paper is to target IPv6-enabled systems on the local network.