darkquasar darkquasar

CVE-2020-0601 AKA ChainOfFools OR CurveBall

Microsoft disclosed a vulnerability in their monthly Patch Tuesday referenced under CVE-2020-0601.
The vulnerability was discovered by the U.S. National Security Agency, anounced today (2020-01-14) in their press conference, followed by a blog post and an official security advisory.
The flaw is located in the "CRYPT32.DLL" file under the C:\Windows\System32\ directory.

NSA description:
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows® cryptographic functionality.

Critical Exposure in Citrix ADC (NetScaler) – Unauthenticated Remote Code Execution

Credit: Suggested steps taken from twitter post by @darkQuassar

Just converted to copy/pastable gist for easy access

	<?xml version="1.0" encoding="UTF-8"?>
	<Annotations start="0" num="171" total="171">
	<Annotation about="www.bussink.net/*" timestamp="0x0005d7bc4022b026" href="ChF3d3cuYnVzc2luay5uZXQvKhCm4IqBxPf1Ag">
	<Label name="_cse_turlh5vi4xc"/>
	<AdditionalData attribute="original_url" value="https://www.bussink.net/"/>
	</Annotation>
	<Annotation about=".thedfirreport.com/" timestamp="0x0005d76dd5f8679d" href="ChUqLnRoZWRmaXJyZXBvcnQuY29tLyoQnc_hr93t9QI">
	<Label name="_cse_turlh5vi4xc"/>
	<AdditionalData attribute="original_url" value="https://thedfirreport.com/"/>
	</Annotation>

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	function Get-Hash
	{
	<#
	.SYNOPSIS

	Get-Hash is a PowerShell Version 2 port of Get-FileHash that supports hashing files, as well as, strings.

	.PARAMETER InputObject

	This is the actual item used to calculate the hash. This value will support [Byte[]] or [System.IO.Stream] objects.

	function Add-ACERootCertificate
	{
	param
	(
	[Parameter(Mandatory = $true)]
	[string]
	$ServerIp,

	[Parameter()]
	[Int32]