privia-security/adzeroZerologon AutoExploit Tool | CVE-2020-1472
The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null (NT hash = 31d6cfe0d16ae931b73c59d7e0c089c0). Thus, the attacker can access the Domain Controller machine using the credentials they created and obtain the credentials of other users. By obtaining the credentials of authorized users, a session with high privileges can be gained on the Domain Controller machine.
python3 -m venv env
source env/bin/activate
pip install -r requirements.txt
python3 ADZero.py dc_ip
Using the ADZero tool developed by the Privia Security team, a Command Prompt session can be obtained with nt authority\system privileges on a Domain Controller machine that has the Zerologon vulnerability.
Running the python3 ADZero.py dc_ip command obtains a Command Prompt session on the Domain Controller machine with the IP address dc_ip.
The ADZero tool sends an SMB login request with null credentials to obtain the dc_name (computer name) and dom_name (domain name) information of the target Domain Controller machine. From the response, the dc_name (computer name) and dom_name (domain) information of the Domain Controller machine can be obtained.
Using the dc_name (computer name), com_name (computer account created by appending the $ symbol to the end of the computer name), and dc_ip (Domain Controller IP address) information, the vulnerability is triggered. As a result of the request made over the Netlogon Remote protocol, the vulnerability is triggered, and the password of com_name (computer account) is set to null (NT hash = 31d6cfe0d16ae931b73c59d7e0c089c0).
Using the secretdump.py module, which is one of the Impacket modules, the password information of the Administrator user from the Domain Controller machine is dumped as an LM:NTLM hash using the com_name (computer account), dom_name, dc_ip, and the empty password created for com_name. Additionally, the LM:NTLM hash obtained during the dump process is written to a file named out.
By using the obtained LM:NTLM hash with the smbexec.py module from the Impacket modules, a Command Prompt session is obtained on the Domain Controller machine. The technique of using the LM:NTLM hash value as a password is called Pass The Hash. A meterpreter session on the Domain Controller machine can be obtained by using the LM:NTLM hash value written to the file named out with the exploit/windows/smb/psexec exploit module in the Metasploit Framework.
