MicrosoftWontFixList - A list of vulnerabilities or design flaws that Mic

项目说明

Microsoft Wont-Fix-List (July 2021 Edition)

11.08.2021 - Update: after all, this might become at least a "we-fixed-most-of-this"-list. We've got a patch for PetitPotam, SeriousSAM and of Print Nightmare, though not for all of them yet. Well...

02.08.2021 - Update: thank you all for your feedback :-) This list was intended to be a summary of what happend in July 2021 and I decided I'll keep it that way, because I honestly think I don't have the energy to maintain an up-to-date list of ALL won't fixes Microsoft has to offer. So I'll keep this remark here for clarity and change the description.

<br>
A list of or design flaws Microsoft does not intend to fix. Since the number is growing, I decided to make a list.
<br>
<br>
LPE = Local Pri Escalation<br>
DPE = Domain-wide Pri Escalation<br>
RCE = Remote Code Execution<br>
<br>

||C Type|It's NTLM again, right?|How it works in a nutshell
| ------------- |-------------| -----|-----|-----|
|SpoolSample|works as designed|Coerce authentication,<br>Coerce target: other computer or localhost,<br>LPE|yes |SpoolSample abuses a functionality of the MS-RPRN (the print system remote protocol) to coerce target A to authenticate to a destination of the attackers choosing (target B). This destination usually is another host running an NTLM relay tool (like ntlmrelayx or inveigh), which in turn relays the target A to the final target, target C. The permissions of target A are then used to execute stuff (e.g. make me domain admin, configure RBCD, add a user, etc...) on target C. A common example of target C is the LDAP service of a domain controller.<br><br> Update: I just learned that this can also be abused for local pri escalation. Have a look at the second link. <br><br>
|PetitPotam|C|Coerce authentication, Coerce target: other computer| yes|PetitPotam is similar to SpoolSample but uses another protocol (MS-EFSRPC). Another benefit of PetitPotam is that you can force the protocol target A uses to authenticate to target B (see SpoolSample explanation) to HTTP. However for this to work, the WebClient service needs to run on target A, which might be not a big deal on clients but the service is not installed by default on servers. So as far as I understand, you're probably stuck with SMB when it comes to servers. explains this nicely in a twitter thread (see references), so maybe have a look at that. <br><br>Update: I just learned that this can also be abused for local pri escalation. Have a look at the third link. <br><br>
|RemotePotato0|works as designed|Coerce Authentication, Coerce target: different user logged in on same machine as attacker| yes|This attack can coerce authentication from another user session on the attackers machine to an attacker-controlled target. Common scenario would be: unpri attacker is logged onto a machine. pri user logs onto that machine with RDP. attacker triggers authentication in the pri session to another, attacker-controlled host. From thereon it's classic NTLM relay again.<br><br>
|SeriousSAM|C|LPE|Kind of|Due to weak default ACLs on the SAM and SYSTEM files, these files can be accessed by unpri users through shadow copies. Sidenote: there's a read lock on the SAM file while in use, therefore you need the shadow copy access path cause you can't read it directly. An unpri user can extract the local admin's password hash and use this to elevate local pri. This could be done using PTH from another host or if you already ha over a process running as Local Service/Network Service then you could use 's tool (see 3rd link). They will definitely fix this but I guess we will be stuck with the insecure shadow copies. <br>Update 11.08.2021: and that's exactly how it happend. See MSRC link for more info.<br><br>
|PrintNightmare|C(RCE), C(RCE), C(LPE), C(LPE), C(RCE), C(RCE)|RCE and LPE|No|A in the print spooler allows an attacker to introduce a malicious DLL that will be executed by the spooler service. This can be used for remote code execution as well as local pri escalation. <br> I assume they will actually fix these since CVEs are assigned. Furthermore, I am of the opinion that the printer spooler needs to lose its SYSTEM rights! <br><br>
|ADCS - ESC8 |works as designed|DPE|Hell yeah|The web interface of the Acti Certificate Services allows NTLM authentication by default and does not enforce relay mitigations (also by default). Therefore you can relay an authentication to that webinterface and request a certificate in the name of the relayed account. E.g. you relay the DC (using PetitPotam for example) and get a DC certificate.<br> <br>

项目信息

开发语言：未知

Star 数：953

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 (and SpoolSample ;-))展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。