CVE-2019-1040 (Drop the MIC) and NTLM Authentication

Vocabulary terms and definitions related to the CVE-2019-1040 'Drop the MIC' vulnerability and NTLM relay attack mechanisms.

MIC (Message Integrity Code)

A signature field added to NTLM AUTHENTICATE messages that cryptographically binds the NEGOTIATE, CHALLENGE, and AUTHENTICATE messages to prevent tampering and relay attacks.

MIC Computation Formula

$$MIC = \text{HMAC\_MD5}(\text{SessionBaseKey}, \text{NEGOTIATE} + \text{CHALLENGE} + \text{AUTHENTICATE})$$

CVE-2019-1040

Also known as "Drop the MIC," a vulnerability where Windows fails to properly validate the MIC's presence or enforcement during NTLM authentication, allowing attackers to strip the MIC and relay messages.

msvAvFlags

A field within the MsvAvFlags AV pair that signals the presence of a MIC; in a "Drop the MIC" attack, this flag is zeroed out to hide the fact that the MIC was removed.

CVE-2019-1040 Flaw 1

The ability to simply remove the MIC field because the server did not properly validate whether the MIC was required or enforced.

CVE-2019-1040 Flaw 2

The ability to strip Sign/Seal flags even when signing is negotiated; because the MIC is removed, the server accepts the authentication without enforcing the signing requirement.

EPA (Extended Protection for Authentication)

A security feature that, when enabled, prevents CVE-2019-1040 attacks from succeeding even on otherwise unpatched targets.

coerce_plus

A module used with netexec to coerce authentication from a target machine, often used in conjunction with attacks like PetitPotam.

dnstool.py

A tool used to add DNS records to a Domain Controller (DC), facilitating NTLM relay attacks by creating a listener host.

PetitPotam.py

A tool used to coerce NTLM authentication from a target to a specified listener.

--remove-mic

An impacket-ntlmrelayx flag used to exploit CVE-2019-1040, allowed for relaying to targets where SMB signing is enabled (e.g., via winrms).

AUTHENTICATE message

The specific NTLM message in the sequence (NEGOTIATE → CHALLENGE → AUTHENTICATE) that contains the Message Integrity Code signature.