Skip to content
This repository has been archived by the owner on Dec 6, 2023. It is now read-only.

add dfscoerce module #596

Merged
merged 1 commit into from
Jun 29, 2022
Merged

add dfscoerce module #596

merged 1 commit into from
Jun 29, 2022

Conversation

ChoiSG
Copy link

@ChoiSG ChoiSG commented Jun 29, 2022

Added a DFSCoerce module that checks if the target DC (or member server) is vulnerable to the MS-DFSNM authentication coercion attack.

The code is from @filip_dragovic's DFSCoerce repo. All of the credit goes to @filip_dragovic (@Wh04m1001 on GitHub).

If the target host is vulnerable

└─# poetry run crackmapexec smb 192.168.40.150 -u Administrator -p 'Password123!' -d choi.local -M dfscoerce
SMB         192.168.40.150  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:choi.local) (signing:True) (SMBv1:False)
SMB         192.168.40.150  445    DC01             [+] choi.local\Administrator:Password123! (Pwn3d!)
DFSCOERC... 192.168.40.150  445    DC01             VULNERABLE
DFSCOERC... 192.168.40.150  445    DC01             Next step: https://github.com/Wh04m1001/DFSCoerce

If the target host is not vulnerable

└─# poetry run crackmapexec smb 192.168.40.151 -u Administrator -p 'Password123!' -d choi.local -M dfscoerce
SMB         192.168.40.151  445    WKSTN01          [*] Windows 10.0 Build 19041 x64 (name:WKSTN01) (domain:choi.local) (signing:False) (SMBv1:False)
SMB         192.168.40.151  445    WKSTN01          [+] choi.local\Administrator:Password123! (Pwn3d!)

I'm not sure if CME accepts additional RPC-based authentication coercion attack checking modules (aside from petitpotam and spooler) or not. Hope it does, I'm getting spoiled with using cme for checking most of the AD misconfigs and vulns during engagements.

@mpgn mpgn merged commit 7e20cef into byt3bl33d3r:master Jun 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants