connormcgarr / CVE-2020-1350

CVE-2020-1350 Proof-of-Concept

CVE-2020-1350

CVE-2020-1350 Proof-of-Concept

Environment Setup

1. Download Windows Server 2016
2. Download a Linux box (a secondary box to run this script)
3. Install Active Directory/DNS on Windows Server 2016 (let's say you named your legitimate domain 33y0re.com)
4. Have NO DNS records on the Windows 2016 server (yet)
5. Create a "forwarder" record on the Windows Server 2016 image with the IP of the Linux box

Usage

1. Choose your domain (the "attacking" domain)
2. Calculate how long it is (e.g. blah is 0x4 bytes and .net is 0x3 bytes)
3. Set domain_correct to \x04blah\03net\x00
4. Run python UDP_Response.py & python TCP_Response.py
5. Run from the Windows Server 2016 Image or Linux Box: nslookup -type=sig 33y0re.com ACTIVE_DIRECTORY_DNS_SERVER_IP followed by: nslookup -type=sig 9.MALICIOUS_DOMAIN_FROM_LINUX_BOX_SCRIPT ACTIVE_DIRECTORY_DNS_SERVER_IP