POC详情： f97de8c222b70f6e32f229f4f65f9cc72d25a769

来源
https://github.com/knightswd/NoPacScan
关联漏洞
标题： Microsoft Windows Active Directory 权限许可和访问控制问题漏洞 (CVE-2021-42287)
描述：Microsoft Windows Active Directory是美国微软（Microsoft）公司的一个负责架构中大型网络环境的集中式目录管理服务。存储有关网络上对象的信息，并使管理员和用户可以轻松查找和使用这些信息。 Microsoft Windows Active Directory存在权限许可和访问控制问题漏洞。以下产品和版本受到影响：Windows Server 2019,Windows Server 2019 (Server Core installation),Windows Serve
描述
NoPacScan is a CVE-2021-42287/CVE-2021-42278 Scanner,it scan for more domain controllers than  other script
介绍
# NoPacScan

NoPacScan is a CVE-2021-42287/CVE-2021-42278 Scanner,it  scan for more domain controllers than the original script, and more accurate than it.It scan DC with DNS search `_msdcs.aaa.com`,it's better than LDAP and SAMR, and it will automatically scan all DC we find.If you use LDAP or SAMR ,maybe you will miss some DC that remove from Primary DC. For more accurate,It scan the Pac where type equal to 0x10 that is the Microsoft main patch for this vulnerable.

Nopac漏洞扫描器，相比其他扫描器能更加精确的扫描更多的DC，通过dns查询`_msdcs.aaa.com`来获取所有的域控制器（相比其他脚本的LDAP获取SAMR协议，通过dns查询能找到那些已经脱域但未在dns中注销的DC）。然后自动扫描所有获取到的DC。漏洞扫描的方式主要是通过获取到解密的PAC文件并查找其中是否有类型为0x10的结构体。（微软打补丁的主要位置）

# Install

Python3.5+impacket

* pip install aiodns

# Usage

```
usage: NopacScan.py [-h] [-debug] [-hashes LMHASH:NTHASH] [-dc-ip ip address] [-dns-ip dns ip address] [-dns-port dns port] credentials

positional arguments:
  credentials           domain/username[:password]

optional arguments:
  -h, --help            show this help message and exit
  -debug                Turn DEBUG output ON

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -dc-ip ip address     IP Address of the domain controller.
  -dns-ip dns ip address
                        Dns search Ip(default is DC-IP)
  -dns-port dns port    Dns search port (default is 53) scan with 
```

## scan

`python3 NopacScan.py windows.local/test:aaaa -dc-ip 172.16.178.9`

scan with a dc-ip(with this dc ip ,it will find more DC with dns search and automatically scan other DC), if you have a dns ip,you can add it with -dns-ip.

通过dc-ip传入域控地址后，将默认通过DC的dns服务器来进行dns查询，并自动扫描所有查询到的DC。

![image-20220215180717215](./example.png)
文件快照

 [4.0K]  /data/pocs/f97de8c222b70f6e32f229f4f65f9cc72d25a769
├── [1.6K]  dnsresolve.py
├── [193K]  example.png
├── [ 16K]  NopacScan.py
└── [2.0K]  README.md

0 directories, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。