| name | exploiting-zerologon-vulnerability-cve-2020-1472 |
| description | Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol using Impacket to reset a domain controller's machine account password to empty, then runs DCSync via secretsdump.py to dump domain credentials. Use when red-teaming or validating unpatched Active Directory domain controllers for Zerologon, including restoring the machine account password afterward. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["zerologon","cve-2020-1472","netlogon","domain-controller","privilege-escalation","active-directory","ms-nrpc"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
| mitre_attack | ["T1595","T1190","T1059","T1078","T1068"] |
Exploiting Zerologon Vulnerability (CVE-2020-1472)
Overview
Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability (CVSS 10.0) in the Microsoft Netlogon Remote Protocol (MS-NRPC). The flaw exists in the cryptographic implementation of AES-CFB8 mode, where the initialization vector (IV) is incorrectly set to all zeros. This allows an unauthenticated attacker with network access to a domain controller to establish a Netlogon session and reset the DC machine account password to empty, achieving full domain compromise. Microsoft patched this vulnerability in August 2020 (KB4571694).
When to Use
- When performing authorized security testing that involves exploiting zerologon vulnerability cve 2020 1472
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding
Prerequisites
- Network access to a Domain Controller (TCP port 135 and dynamic RPC ports)
- No authentication required (unauthenticated exploit)
- Target DC must not have the February 2021 enforcement mode enabled
- Impacket toolkit installed
- Written authorization for red team engagement
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
MITRE ATT&CK Mapping
| Technique ID | Name | Tactic |
|---|
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
| T1210 | Exploitation of Remote Services | Lateral Movement |
| T1003.006 | OS Credential Dumping: DCSync | Credential Access |
| T1078.002 | Valid Accounts: Domain Accounts | Persistence |
Vulnerability Technical Details
Root Cause
The Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:
- The IV is hardcoded to 16 bytes of zeros
- When the plaintext is 8 bytes of zeros, AES-CFB8 produces a ciphertext of all zeros with probability 1 in 256
