The developers of the Samba project users that recently in Windows the ZeroLogin vulnerability () and in the domain controller implementation based on Samba. The vulnerability shortcomings in the MS-NRPC protocol and the AES-CFB8 cryptographic algorithm, and upon successful exploitation allows an attacker to gain administrator access to the domain controller.
The essence of the vulnerability is that the MS-NRPC (Netlogon Remote Protocol) allows for falling back to an unencrypted RPC connection during authentication data exchanges. After this, an attacker can use a flaw in the AES-CFB8 algorithm to spoof a successful system login. On average, about 256 spoofing attempts are required to gain administrator rights. No valid account on the domain controller is needed for the attack; spoofing attempts can be made using an incorrect password. An authentication request via NTLM will be redirected to the domain controller, which will return an access denial, but the attacker can substitute this response, and the attacked system will consider the login successful.
In Samba, the vulnerability manifests only in systems that do not use the ‘server schannel = yes’ setting, which has been default since Samba 4.8. In particular, systems with the settings ‘server schannel = no’ and ‘server schannel = auto’ could be compromised, as they allow Samba to use the same flaws in the AES-CFB8 algorithm as in Windows.
When using a reference exploit prototype prepared for Windows ). Attempts to trace attacks on systems can be made by analyzing the records mentioning ServerAuthenticate3 and ServerPasswordSet in Samba audit logs., , , VxLAN factory. Part 3
Forrás: opennet.ru
