CVEs-PoC/2019/CVE-2019-1019.md

CVE-2019-1019

Description

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.

POC

Reference

• http://packetstormsecurity.com/files/153639/Microsoft-Windows-HTTP-To-SMB-NTLM-Reflection-Privilege-Escalation.html

Github

• https://github.com/FDlucifer/Proxy-Attackchain
• https://github.com/preempt/ntlm-scanner