T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2020-1472/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2020-1472
+alias: Zerologon — Netlogon AES-CFB8 all-zero IV
+cwe_primary: CWE-330
+cwe_acceptable: [CWE-330, CWE-326, CWE-1204, CWE-327, CWE-310, CWE-339]
+target_file: source.c
+vuln_lines: [37, 38, 39, 40, 41, 42, 43]
+severity: critical
+vuln_class: weak_cryptography
+exploit_pattern_regex: '(memset.*iv.*0|iv\s*=\s*\{?\s*0|all[-\s]?zero|brute[-\s]?force)'
+must_mention_any:
+  - all-zero
+  - fixed iv
+  - cfb8
+  - brute force
+  - authentication bypass
+  - 1/256
+  - weak cryptography
+  - predictable
+points: 30
+notes: |
+  Vulnerability: compute_netlogon_credential uses an ALL-ZERO IV with AES-CFB8.
+  Combined with attacker control of client_challenge and the 1/256 probability
+  of a zero-collapsing session key, this allows authentication bypass.
+  Hunter MUST identify:
+    1. The IV is hard-coded zero (memset to 0).
+    2. CFB8 with controlled plaintext and predictable IV is exploitable.
+    3. Bypass results in arbitrary Netlogon authentication.

bench/cve-hunt/samples/CVE-2020-1472/source.c

@@ -0,0 +1,42 @@
+/*
+ * Netlogon ComputeNetlogonCredential (AES-CFB8 mode) — pre-CVE-2020-1472.
+ * The legacy Netlogon authentication primitive uses AES-CFB8 with an
+ * ALL-ZERO initialization vector.  An attacker who controls the client
+ * challenge can brute-force a match for the server credential in seconds
+ * because 1 in 256 random session keys yield an all-zero output for an
+ * all-zero IV-input.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+static void aes_cfb8_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+                             const uint8_t key[16], const uint8_t iv[16]) {
+    /* CFB8: encrypt 16-byte IV with AES, XOR top byte with plaintext byte,
+       shift IV left by 1 byte, push ciphertext byte into IV's tail. */
+    uint8_t state[16];
+    memcpy(state, iv, 16);
+    for (size_t i = 0; i < len; ++i) {
+        uint8_t block[16];
+        /* aes128_encrypt(state, key, block); */
+        block[0] = state[0] ^ key[0];  /* placeholder for benchmark */
+        out[i] = in[i] ^ block[0];
+        memmove(state, state + 1, 15);
+        state[15] = out[i];
+    }
+}
+
+/* Caller passes iv = {0}, the broken bit. */
+void compute_netlogon_credential(const uint8_t client_challenge[8],
+                                 const uint8_t session_key[16],
+                                 uint8_t out_credential[8]) {
+    /* BUG: IV is ALL-ZERO, fixed by spec. Combined with attacker control
+       of client_challenge and 1/256 brute-force probability, the attacker
+       can forge a credential matching ANY server, including the domain
+       controller. Result: authentication bypass against Active Directory. */
+    uint8_t iv[16];
+    memset(iv, 0, sizeof(iv));
+
+    aes_cfb8_encrypt(client_challenge, out_credential, 8, session_key, iv);
+}