CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
- Published
- Aug 17, 2020
- Updated
- Oct 21, 2025
- Assigning CNA
- microsoft
- Evidence observed
- Nov 18, 2020
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
Sources
modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_admin/dcerpc/cve_2020_1472_zerologon.check)
cve-2020-1472_Tool collection
- ZeroLogon-CVE-2020-1472-labInformational
Explicação e demonstração da vulnerabilidade ZeroLogon (CVE-2020-1472)
- CVE-2020-1472Exploit
Python exploit that tests domain controllers for Zerologon (CVE-2020-1472) and resets the vulnerable machine account password through Netlogon authentication bypass.
- CVE-2020-1472Scanner
Test tool for CVE-2020-1472
- CVE-2020-1472Exploit
Exploit for CVE-2020-1472 (ZeroLogon) that resets the domain controller account password and enables DCSync for full domain compromise.
- zerologon-pocExploit
A script to exploit CVE-2020-1472 (Zerologon)
- CVE-2020-1472Scanner
Python script using Impacket to test for CVE-2020-1472 (Zerologon) vulnerability via Netlogon authentication bypass on Windows domain controllers.
- ZeroLogon-to-ShellExploit
Automated exploit script combining CVE-2020-1472 (ZeroLogon) with evil-winrm to gain a remote shell on vulnerable Windows Domain Controllers.
- CVE-2020-1472Exploit
CVE-2020-1472 - Zero Logon vulnerability Python implementation
- zerologonExploit
Scripts to test and exploit the Zerologon vulnerability (CVE-2020-1472) in Active Directory, enabling password reset and hash dumping of domain controllers.
C# checker for CVE-2020-1472 (ZeroLogon) that detects vulnerable domain controllers by testing the Netlogon authentication flaw.
- CVE-2020-1472Exploit
Python exploit for CVE-2020-1472 (Netlogon Elevation of Privilege) targeting domain controllers to achieve full domain compromise.
PoC for Zerologon - all research credits go to Tom Tervoort of Secura
- CVE-2020-1472Exploit
Exploit script for CVE-2020-1472 (ZeroLogon) with automated privilege escalation, credential dumping via secretsdump, and lateral movement using wmiexec for Active Directory domain compromise.
- CVE-2020-1472Exploit
Proof-of-concept exploit for CVE-2020-1472 (ZeroLogon) that changes the domain controller machine account password, enabling DCSync and full domain compromise. Includes restore functionality.
- CVE-2020-1472-02-Scanner
Python script using Impacket to test for the Zerologon vulnerability (CVE-2020-1472) by attempting Netlogon authentication bypass on domain controllers.
Python script using Impacket to test for the Zerologon vulnerability (CVE-2020-1472) by attempting Netlogon authentication bypass on Domain Controllers.
- CVE-2020-1472Scanner
Python script using Impacket to test domain controllers for the Zerologon vulnerability (CVE-2020-1472) via Netlogon authentication bypass, with detection for patched systems.
- MassZeroLogonScanner
Tool for mass testing ZeroLogon vulnerability CVE-2020-1472
- CVE-2020-1472Exploit
Proof-of-concept exploit for CVE-2020-1472 (ZeroLogon) that changes the domain controller's machine account password, enabling DCSync and full domain compromise. Includes restore functionality.
- ZeroLogon-ExploitExploit
Modified the test PoC from Secura, CVE-2020-1472, to change the machine password to null
- Zerologon_CVE-2020-1472Research
Step-by-step lab guide for simulating, detecting, and mitigating the Zerologon vulnerability (CVE-2020-1472) on Windows Server 2016 using Kali Linux and Impacket tools.
- CVE-2020-1472-EXPExploit
Ladon Moudle CVE-2020-1472 Exploit 域控提权神器
- cve-2020-1472Scanner
Python script to test domain controllers for CVE-2020-1472 (Zerologon) using Impacket. Performs Netlogon authentication bypass detection with minimal false negatives.
- MassZeroLogonExploit
Tool for mass testing ZeroLogon vulnerability CVE-2020-1472
Lab introduction to ZeroLogon
- CVE-2020-1472-EasyExploit
A simple implementation/code smash of a bunch of other repos
- ZeroLogon-PoC-DC-PwnExploit
Zerologon (CVE-2020-1472) Proof-of-Concept application - Critical Active Directory vulnerability exploitation tool.
- cve-2020-1472Exploit
cve-2020-1472 复现利用及其exp
- CVE-2020-1472Exploit
[CVE-2020-1472] Netlogon Remote Protocol Call (MS-NRPC) Privilege Escalation (Zerologon)
- CVE-2020-1472Exploit
CVE-2020-1472复现流程
- CVE-2020-1472Exploit
https://github.com/dirkjanm/CVE-2020-1472
End-to-end Domain Controller exploitation using Metasploit and Impacket: discovered DC10, exploited Zerologon (CVE-2020-1472), extracted NTLM hashes, gained SYSTEM shell, and established a Meterpreter session.
- ADZeroExploit
Zerologon AutoExploit Tool | CVE-2020-1472
Python script using Impacket to test for the Zerologon vulnerability (CVE-2020-1472) by attempting Netlogon authentication bypass against domain controllers.
- zerologonExploit
Exploit for zerologon cve-2020-1472
- ZeroLogonExploit
CVE-2020-1472 C++
- cve-2020-1472Exploit
Exploit for CVE-2020-1472 (Zerologon) that resets domain controller machine account password, enabling credential dumping and privilege escalation to domain admin.
- zerologonExploit
Zerologon Check and Exploit - Discovered by Tom Tervoort of Secura and expanded on @Dirkjanm's cve-2020-1472 coded example. This tool will check, exploit and restore password to original state
- CVE-2020-1472Exploit
Exploit for CVE-2020-1472, a Windows NetLogon privilege escalation vulnerability, using Impacket to achieve domain admin compromise.
- CVE-2020-1472Exploit
Exploit for CVE-2020-1472 (ZeroLogon) that changes a domain controller's machine account password, enabling DCSync and full domain compromise. Includes restore functionality.
- zerologon-CVE-2020-1472Exploit
PoC for Zerologon (CVE-2020-1472) - Exploit
- dirkjanm-CVE-2020-1472Exploit
Exploit for CVE-2020-1472 (Zerologon) that resets the domain controller account password, enabling DCSync, with restoration steps to revert changes.
Python script using Impacket to test for the Zerologon vulnerability (CVE-2020-1472) by attempting Netlogon authentication bypass against domain controllers.
A practical proof-of-concept for CVE-2020-1472 (Zerologon) using the Impacket library to exploit Netlogon vulnerability and perform unauthorized domain controller access.
- CVE-2020-1472Exploit
Exploit Code for CVE-2020-1472 aka Zerologon
Python exploit for CVE-2020-1472 (Zerologon) that changes a domain controller's machine account password, enabling DCSync and full domain compromise. Includes a restore script to revert the password.
- Zerologon_CVE-2020-1472Scanner
POC for checking multiple hosts for Zerologon vulnerability
- zerologonExploit
zerologon script to exploit CVE-2020-1472 CVSS 10/10
- zerologonPoC
Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB
- zer0dumpExploit
Abuse CVE-2020-1472 (Zerologon) to take over a domain and then repair the local stored machine account password.
- Zero-Logon-ExploitExploit
Python script exploiting Zerologon (CVE-2020-1472) to perform Netlogon authentication bypass and reset domain controller password to null.
CVE-2020-1472漏洞复现过程
- ZerologonExploit
Exploit Code for CVE-2020-1472 aka Zerologon
Initialized & connected PostgreSQL to Metasploit. Reconnoitered 10.1.16.0/24 with Nmap and imported results. Enumerated hosts/services using SYN, SMB & LDAP scanners. Exploited DC10 via ZeroLogon (CVE-2020-1472), dumped AD NTLM hashes with Impacket, performed Pass-the-Hash, then gained a Meterpreter reverse shell.
- CVE-2020-1472Exploit
Exploit for CVE-2020-1472 (Zerologon) that exploits a cryptographic flaw in Netlogon to escalate privileges to domain admin in Active Directory environments.
- zerologon-labExploit
Scripts for a lab environment demonstrating the Zerologon (CVE-2020-1472) vulnerability.
- CVE-2020-1472Exploit
Python exploit for CVE-2020-1472 (Zerologon) targeting Netlogon authentication to compromise Active Directory domain controllers and escalate privileges.
- The_big_ZeroExploit
The following is the outcome of playing with CVE-2020-1472 and attempting to automate the process of gaining a shell on the DC
- CVE-2020-1472Exploit
Python exploit for CVE-2020-1472 (Zerologon) targeting Netlogon authentication bypass to escalate privileges and compromise Active Directory domain controllers.
- zerologon-cve-2020-1472-notesResearch
Technical notes and analysis of the Zerologon vulnerability (CVE-2020-1472) in Windows Active Directory, covering exploitation techniques and mitigation strategies.
- 0logonExploit
MS-NRPC (Microsoft NetLogon Remote Protocol)/CVE-2020-1472
- CVE-2020-1472Exploit
Exploit for CVE-2020-1472 (Zerologon) targeting Windows Netlogon to achieve privilege escalation and domain controller compromise.
- CVE-2020-1472Exploit
CVE-2020-1472复现时使用的py文件整理打包
- CVE-2020-1472-visualizerExploit
Visualization tool for CVE-2020-1472 (Zerologon) to identify and exploit vulnerable domain controllers in Active Directory environments.
- CVE-2020-1472Exploit
CVE-2020-1472
West Shepherd · windows · Nov 18, 2020
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.