关联漏洞
标题:Microsoft Windows 安全特征问题漏洞 (CVE-2019-1040)Description:Microsoft Windows和Microsoft Windows Server都是美国微软（Microsoft）公司的产品。Microsoft Windows是一套个人设备使用的操作系统。Microsoft Windows Server是一套服务器操作系统。 Microsoft Windows中存在安全漏洞。攻击者可利用该漏洞绕过NTLM MIC保护。以下产品及版本受到影响：Microsoft Windows 10，Windows 10版本1607，Windows 10版本1703，Windows
介绍
# CVE-2019-1040 scanner
Checks for CVE-2019-1040 vulnerability over SMB.
The script will establish a connection to the target host(s) and send
an invalid NTLM authentication. If this is accepted, the host is vulnerable to
CVE-2019-1040 and you can execute the [MIC Remove attack](https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/) with ntlmrelayx.
Note that this does not generate failed login attempts as the login information itself is valid, it is just the NTLM message integrity code that is absent, which is why the authentication is refused without increasing the badpwdcount.
# Usage
The script requires a recent impacket version. Should work with both python 2 and 3 (Python 3 requires you to use impacket from git).
```
[*] CVE-2019-1040 scanner by @_dirkjan / Fox-IT - Based on impacket by SecureAuth
usage: scan.py [-h] [-target-file file] [-port [destination port]]
[-hashes LMHASH:NTHASH]
target
CVE-2019-1040 scanner - Connects over SMB and attempts to authenticate with
invalid NTLM packets. If accepted, target is vulnerable to MIC remove attack
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
optional arguments:
-h, --help show this help message and exit
connection:
-target-file file Use the targets in the specified file instead of the
one on the command line (you must still specify
something as target name)
-port [destination port]
Destination port to connect to SMB Server
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
```
文件快照
[4.0K] /data/pocs/680289c715e661f821d6de8a399c3ba1ceb85138
├── [1.0K] LICENSE
├── [1.7K] README.md
└── [8.9K] scan.py
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。