9.3
CVSSv2

CVE-2020-1472

Published: 17/08/2020 Updated: 18/09/2020
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Microsoft Windows could allow a remote malicious user to gain elevated privileges on the system, caused by an error when establisheing a vulnerable Netlogon secure channel connection to a domain controller. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

Vulnerability Trend

Mailing Lists

In August, Microsoft patched CVE-2020-1472, which gives administrator access to an unauthenticated user on a Domain Controller Microsoft gave it a CVSS score of 10 portalmsrcmicrosoftcom/en-us/security-guidance/advisory/CVE-2020-1472#ID0EUGAC The Samba security team was not contacted before the announcement, which is very sparse on ...

Github Repositories

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string NOTE: It will likely break things in production environments (eg DNS functionality, communication with replication Domain Controller

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures Do note that by default this changes the password of the domain controller account Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! More info and original research here Exploit steps Read the blog/whitepaper above so

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures Do note that by default this changes the password of the domain controller account Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! More info and original research here Exploit steps Read the blog/whitepaper above so

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures Do note that by default this changes the password of the domain controller account Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! More info and original research here Exploit steps Read the blog/whitepaper above so

Invoke-ZeroLogon This code was heavily adapted from the C# implementation by the NCC Group's Full Spectrum Attack Simulation team and the original CVE published by Secura This script can be run in two modes: When the reset parameter is set to True, the script will attempt to reset the target computer’s password to the default NTLM hash (essentially an empty passwor

CFB8 Zero Bytes Attack ❯ python cfb8_zero_bytes_attackpy [!] Attack Success Number of trials: 275 Key: b'U\x1e\x9eoKd\x18\xdf\x0c\x05\xfc3\x1f4\xd9\x8e' IV: b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' Plaintext: b'\x00\x00\x00\x00\x00\x00\x00\x00' Ciphertext: b'\x00\x00\x00\x00\x00\x00\x00\x00' Reference Zerolo

CVE-2020-1472 - Zero Logon vulnerability Python implementation

CVE-2020-1472 CVE-2020-1472 - Zero Logon vulnerability Python implementation

Awesome Systools is a collection of sysadmins daily handy tools.

Awesome Systools Lists The Book of Secret Knowledge Awesome-Selfhosted: This is a list of Free Software network services and web applications which can be hosted locally Selfhosting is the process of locally hosting and managing applications instead of renting from SaaS providers Lucid Index: This site's goal is to help you find the software you need as quickly as possi

PoC for Zerologon (CVE-2020-1472) - Research credits to Tom Tervoort of Secura & exploit credits to dirkjanm

CVE-2020-1472 - Zero-Logon POC This exploit requires you to use the latest impacket from GitHub Ensure impacket installation is done with netlogon structures added Note : By default, successful exploitation changes the password of the DC Account Allows DCSync Breaks communication with other domain controllers (Be careful!) Original Research & information here

第一步 pip3 install -r requirementstxt 查看hash secretsdumppy molecule-labscom/administrator:Aa123456@192168175132 -just-dc-user 'AD$' 攻击 python3 CVE-2020-1472py AD AD$ 192168175132 查询域控hash secretsdumppy molecule-labscom/'AD$'@192168175132 -just-dc-user 'AD$' -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 恢复hash

Test tool for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit (CVE-2020-1472) It attempts to perform the Netlogon authentication bypass The script will immediately terminate when succesfully performing the bypass, and not perform any Netlogon operations When a domain controller is patched, the detection script will gi

Ladon Moudle CVE-2020-1472 Exploit

CVE-2020-1472-EXP Ladon Moudle CVE-2020-1472 Exploit

CVE-2020-1472漏洞复现过程

CVE-2020-1472 CVE-2020-1472漏洞复现过程 过程详见:blogcsdnnet/mukami0621/article/details/108605941

cve-2020-1472 复现利用及其exp

CVE-2020-1472 POC mac环境下通过proxychains代理的方式在window域环境中复现该漏洞。 Environment DC(主域控制器): Domain User(域成员主机): 通过gost直接设置socks5正向代理。 Attack Hacker(攻击机): 设置proxychains4 vim /Users/xq17/proxychains/proxychainsconf 增加PrxoyList列表 [ProxyList] socks5 102115542 8099 Attack Tools(

https://github.com/dirkjanm/CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures Do note that by default this changes the password of the domain controller account Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! More info and original research here Exploit steps Read the blog/whitepaper above so

[CVE-2020-1472] Netlogon Remote Protocol Call (MS-NRPC) Privilege Escalation (Zerologon)

[CVE-2020-1472] Netlogon Remote Protocol Call (MS-NRPC) Privilege Escalation (Zerologon) The attack described here takes advantage of flaws in a cryptographic authentication protocol (insecure use of AES-CFB8) that proves the authenticity and identity of a domain-joined computer to the Domain Controller (DC) Due to incorrect use of an AES mode of operation it is possible to sp

Zerologon Summary A Zeek detection package for CVE-2020-1472, also known as Zerologon, which is a CVSS 100 privilege escalation vulnerability against the Netlogon protocol for Windows Server domain controllers Notices By default, both notices are raised: Zerologon_Attempt indicates the requisite number of login attempts were made within a short period of time Zerologon_Pass

Exploit Code for CVE-2020-1472 aka Zerologon

CVE-2020-1472 Exploit Code for CVE-2020-1472 aka Zerologon

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit (CVE-2020-1472) It attempts to perform the Netlogon authentication bypass The script will immediately terminate when succesfully performing the bypass, and not perform any Netlogon operations When a domain controller is patched, the detection script will gi

Zerologon Exploit Script This script is used to test and exploit unpatched Domain Controllers for the Zerologon Vulnerability (CVE-2020-1472) More information on this vulnerability can by found here: wwwsecuracom/blog/zero-logon The PoC code for detection was provided by SecuraBV and can be found here: githubcom/SecuraBV/CVE-2020-1472 The exploit code has be

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472 exploit来源: githubcom/dirkjanm/CVE-2020-1472 githubcom/SecuraBV/CVE-2020-1472

Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472. Monitors event ID's 5827, 5828 & 5829. See: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472

zabbix-template-CVE-2020-1472 Zabbix Template to monitor for Windows Event Viewer event's related to Netlogon Elevation of Privilege Vulnerability - CVE-2020-1472 Monitors event ID's 5827, 5828 & 5829 portalmsrcmicrosoftcom/en-US/security-guidance/advisory/CVE-2020-1472

Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB

Zerologon test for SMB & RPC A python script based on SecuraBV script Demonstrates that CVE-2020-1472 can be done via RPC/SMB, and not only over RPC/TCP Additionaly, there is a random byte in the final client challange & client credential - to test against trivial IDS signatures The RPC/SMB scan runs by default Depending on the target server, some may requir

CVE-2020-1472复现时使用的py文件整理打包

CVE-2020-1472 CVE-2020-1472复现时使用的py文件整理打包

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit (CVE-2020-1472) It attempts to perform the Netlogon authentication bypass The script will immediately terminate when successfully performing the bypass, and not perform any Netlogon operations When a domain controller is patched, the detection script will g

Zeek package to detect Zerologon

Zerologon Summary A Zeek detection package for CVE-2020-1472, also known as Zerologon, which is a CVSS 100 privilege escalation vulnerability against the Netlogon protocol for Windows Server domain controllers Notices By default, both notices are raised: Zerologon_Attempt indicates the requisite number of login attempts were made within a short period of time Zerologon_Pass

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit (CVE-2020-1472) It attempts to perform the Netlogon authentication bypass The script will immediately terminate when succesfully performing the bypass, and not perform any Netlogon operations When a domain controller is patched, the detection script will gi

PoC auto collect from GitHub.

PoC in GitHub 2020 CVE-2020-0022 In reassemble_and_dispatch of packet_fragmentercc, there is possible out of bounds write due to an incorrect bounds calculation This could lead to remote code execution over Bluetooth with no additional execution privileges needed User interaction is not needed for exploitationProduct: AndroidVersions: Android-80 Android-81 Android-9 Andr

Recent Articles

Windows Exploit Released For Microsoft ‘Zerologon’ Flaw
Threatpost • Lindsey O'Donnell • 15 Sep 2020

Proof-of-concept (PoC) exploit code has been released for a Windows flaw, which could allow attackers to infiltrate enterprises by gaining administrative privileges, giving them access to companies’ Active Directory domain controllers (DCs).
The vulnerability, dubbed “Zerologon,” is a privilege-escalation glitch (CVE-2020-1472) with a CVSS score of 10 out of 10, making it critical in severity. The flaw was addressed in Microsoft’s August 2020 security updates. However, this week at...

Windows Zerologon PoC exploits allow domain takeover. Patch Now!
BleepingComputer • Lawrence Abrams • 15 Sep 2020

Researchers have released exploits for the Windows Zerologon CVE-2020-1472 vulnerability that allow an attacker to take control of a Windows domain. Install patches now!
As part of the August 2020 Patch Tuesday security updates, Microsoft fixed a critical 10/10 rated security vulnerability known as 'CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability'.



PLAY

Two 0-Days Under Active Attack, Among 120 Bugs Patched by Microsoft
Threatpost • Tom Spring • 11 Aug 2020

Two Microsoft vulnerabilities are under active attack, according the software giant’s August Patch Tuesday Security Updates. Patches for the flaws are available for the bugs, bringing this month’s total number of vulnerabilities to 120.
One of the flaws being exploited in the wild is (CVE-2020-1464), a Windows-spoofing bug tied to the validation of file signatures on Windows 10, 7 8.1 and versions of Windows Server. Rated “important,” the flaw allows an adversary to “bypass secur...

The Register

Patch Tuesday Patch Tuesday used to be Microsoft's day to release patches. Now Adobe, Intel, and SAP are routinely joining the fun – with special guest star Red Hat this month.
If you've felt overwhelmed by the sheer number of security patches Microsoft has emitted this year, you are not alone. Patch watchers at the Zero Day Initiative said that, including the 120 product security bulletins posted this August, Microsoft is just 11 patches away from surpassing its 2019 full-year total wit...