CVE-2019-1040
MEDIUM EXPLOITED IN THE WILDMicrosoft Windows - Privilege Escalation
Title source: llmExploitation Summary
CVE-2019-1040 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 7 public exploits from researchers including fox-it, Ridter, QAX-A-Team.
AI-analyzed exploit summary This repository contains a scanner for CVE-2019-1040, which checks for vulnerability to the MIC Remove attack by sending invalid NTLM authentication packets over SMB. It does not exploit the vulnerability but detects if the target is vulnerable.
Description
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. To exploit this vulnerability, the attacker would need to tamper with the NTLM exchange. The attacker could then modify flags of the NTLM packet without invalidating the signature. The update addresses the vulnerability by hardening NTLM MIC protection on the server-side.
Exploits (7)
This repository contains a scanner for CVE-2019-1040, which checks for vulnerability to the MIC Remove attack by sending invalid NTLM authentication packets over SMB. It does not exploit the vulnerability but detects if the target is vulnerable.
This repository contains a functional exploit for CVE-2019-1040, leveraging the NTLM relay attack via the PrinterBug technique to trigger authentication and relay credentials. It includes modules for SMB and HTTP relay servers, as well as utilities for dumping secrets and restoring operations.
This repository contains a functional Python exploit for CVE-2019-1040, leveraging NTLM relay attacks to manipulate LDAP and Kerberos authentication. The script automates the creation of machine accounts and exploits the vulnerability to achieve privilege escalation or lateral movement.
This repository contains a functional exploit for CVE-2019-1040, which leverages NTLM relay vulnerabilities combined with Kerberos delegation to achieve remote code execution and potential domain admin privileges. The tool, `dcpwn.py`, automates the exploitation process by integrating with Impacket and includes modules for various attack vectors such as SMB, LDAP, and HTTP relay attacks.
This repository contains a functional exploit for CVE-2019-1040, which leverages LLMNR poisoning and NTLM relay attacks to achieve remote code execution (RCE). The tool is an updated version of UltraRelay, incorporating the `--remove-mic` flag to bypass NTLM mitigation by exploiting the MIC (Message Integrity Code) removal vulnerability.
This repository contains a functional exploit for CVE-2019-1040, leveraging the Print Spooler service to achieve local privilege escalation (LPE) via named pipe impersonation. The code includes reflective DLL injection and RPC-based exploitation techniques.
This repository contains a functional exploit for CVE-2019-1040, which leverages NTLM relay vulnerabilities in Exchange servers to achieve remote code execution and domain admin privileges. The code includes modules for various relay attacks (SMB, LDAP, HTTP, etc.) and integrates with Impacket for authentication and execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N