8

GitHub - byt3bl33d3r/ItWasAllADream: A PrintNightmare (CVE-2021-3457) Python Sca...

 3 years ago
source link: https://github.com/byt3bl33d3r/ItWasAllADream
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

It Was All A Dream

A CVE-2021-34527 (a.k.a PrintNightmare) Python Scanner. Allows you to scan entire subnets for the PrintNightmare RCE (not the LPE) and generates a CSV report with the results. Tests exploitability over MS-PAR and MS-RPRN.

This tool has "de-fanged" versions of the Python exploits, it does not actually exploit the hosts however it does use the same vulnerable RPC calls used during exploitation to determine if hosts are vulnerable.

POV, trying to determine if something is vulnerable to PrintNightmare:

At the time of writing, the amount of variables that determine if a machine is vulnerable is crazy and confusing.

Alternatives

Installation

This tool currently needs cube0x0's Impacket fork containing the MS-PAR implementation necessary for one of the checks. This change has been submitted to Impacket in this pull request.

Docker:

git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && docker build -t itwasalladream .
docker run -it itwasalladream -u user -p password -d domain 192.168.1.0/24

Dev install requires Poetry:

git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && poetry install && poetry shell
itwasalladream -u user -p password -d domain 192.168.1.0/24

Usage

usage: itwasalladream [-h] -u USERNAME [-p PASSWORD] -d DOMAIN [--timeout TIMEOUT] [--threads THREADS] [-v] target

PrintNightmare (CVE-2021-34527) scanner

positional arguments:
  target                Target subnet in CIDR notation

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --username USERNAME
                        username to authenticate as (default: None)
  -p PASSWORD, --password PASSWORD
                        password to authenticate as. If not specified will prompt. (default: None)
  -d DOMAIN, --domain DOMAIN
                        domain to authenticate as (default: None)
  --timeout TIMEOUT     Connection timeout in secods (default: 30)
  --threads THREADS     Max concurrent threads (default: 100)
  -v, --verbose         Enable verbose output (default: False)

I used to read Word Up magazine!

As the exploit requires you to be authenticated to Active Directory, you need to supply credentials. If the password isn't supplied it will prompt you to enter it.

By default it will use 100 threads, you can increase/decrease these using the -t argument.

After its done you'll see a report_<timestamp>.csv file in your current directory with the results.

Credits


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK