CVE-2015-0006 PoC — Microsoft NLA安全功能规避漏洞

Source

Associated Vulnerability

Title:Microsoft NLA安全功能规避漏洞 (CVE-2015-0006)
Description:Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。Network Location Awareness（NLA）是其中的一个网络位置感知服务。 Microsoft NLA服务可能会无意中放松防火墙策略和/或某些服务的配置，而安全功能规避漏洞正是存在于该服务中。这可能会增加暴露给攻击者的表面。当NLA服务无法正确验证域连接的计算机已连接到域还是连接到不可信的网络时，就会导致该漏洞。以下产品和版本受到影响：Microsoft Windows Server 2003

Description

Proof of concept for CVE-2015-0006. Fixed in MS15-005 https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-005 .

Readme

# IMPOSTER

A pentest tool used to attack windows clients on rogue networks.

## Current version

###Features

* Downgrade LDAP to NTLM authentication
* Fake initial steps of an domain controller to fool Network Location Awareness

### Servers
DNS, CLDAP, LDAP

## Setup

The current version have been tested on Kali Linux but should on other operating systems as well.

### Dependencies

* pyasn1
* dnspython

### Quick setup on Kali Linux
Use the following steps to setup imposter on a Kali Linux machine.
```
git clone https://github.com/bugch3ck/imposter.git
cd imposter/src
git clone https://github.com/rthalley/dnspython.git
ln -s dnspython/dns dns
apt-get install pyasn1
```

## Changelog

### Version 0.1
Private release 2014-06-05. Implements DNS, CLDAP and LDAP. Can downgrade LDAP bind to use NTLM and fake successful authentication to trick Network Location Awareness to set the domain policy.

File Snapshot


 [4.0K]  /data/pocs/0f186a79892b480577370224b46c6d695a2565ab
├── [ 906]  README.md
└── [4.0K]  src
    ├── [1.8K]  imposter.py
    ├── [1.5K]  mscldap_server.py
    ├── [2.4K]  mscldap_utils.py
    ├── [2.1K]  msdns_server.py
    ├── [3.1K]  msldap_server.py
    ├── [2.5K]  msldap_utils.py
    ├── [4.0K]  ntlm.py
    ├── [4.0K]  proto
    │   ├── [  56]  cldap.py
    │   ├── [   0]  __init__.py
    │   ├── [  23]  ldap.py
    │   ├── [ 658]  rfc1798.py
    │   └── [ 22K]  rfc2251.py
    └── [ 112]  servers.py

2 directories, 14 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!