zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

SecuraBV-CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

CVE-2020-1472

CVE-2020-1472 Netlogon 원격 프로토콜 호출MS-NRPC 권한 상승 Zerologon 여기에 설명된 공격은 도메인 가입 컴퓨터의 신뢰성과 신원을 도메인 컨트롤러DC에 증명하는 암호화 인증 프로토콜AES-CFB8의 안전하지 않은 사용의 결함을 이용합니다. AES 운영 모드의 잘못된 사용으로 인해 모든 컴퓨터 계정DC 자체 포함의 신원을 스푸핑하고 해당 도메인 계정에 빈 암호여러 필드가 0으로 채워진 여러 Netlogon 메시지를 보내는 것만으로를 설정할 수 있습니다. 이후 이를 사용하여 도메인 관리자 자격 증명을...

redteam-research

Red Team Research Collection of PoC and offensive techniques used by the BlackArrow Red Team License All the code included in this project is licensed under the terms of the MIT license...

CVE-2020-1472

CVE-2020-1472 Packaged py files used in reproducing CVE-2020-1472 The examples path contains the directory where the exp files are located; the rest are import packages, just ignore them Corresponding blog post: https://www.svenbeast.com/post/fu-xian-cve-2020-1472-netlogon-te-quan-ti-sheng-lou-do...

CVE-2020-1472

Windows NetLogon Privilege Escalation Vulnerability Reproduction CVE-2020-1472 You need to extract impacket.zip to the current folder The latest impacket package can be downloaded here: https://github.com/SecureAuthCorp/impacket For the specific process, please refer to the article:...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analyze critical Windows service security vulnerabilities This repository provides tools to analyze and test the Netlogon vulnerability known as CVE-2026-41089. This tool helps security professionals identify if their Windows Domain Controllers face risks from this...

dirkjanm-CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472-LAB

ZeroLogon testing script A lab setup to test a vulnerability for the ZeroLogon exploit CVE-2020-1472. It contains a Python script that uses the Impacket library to test the vulnerability, and a Virtual Machine VM with Windows Server 2019 configured as a Domain Controller DC. The script attempts t...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

zerologon-CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC This exploit requires you to use the latest impacket from GitHub. Ensure impacket installation is done with netlogon structures added. Note : 1. By default, successful exploitation changes the password of the DC Account. 2. Allows DCSync 3. Breaks communication with...

CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

CVE-2020-1472 ZeroLogon 検出および緩和デモ このプロジェクトは、ZeroLogon としても知られる深刻なWindows脆弱性CVE-2020-1472の検出と緩和を示しています。この脆弱性により、攻撃者は認証なしで管理者アクセスを取得できます。これは学校のサイバーセキュリティプロジェクトの一環として開発されました。PoCコードのクレジットはTom Tervoort（Secura）に、SuricataルールセットのクレジットはProofpoint Emerging Threatsに帰属します。 主な構成要素:...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

CVE-2020-1472

Script de prueba de ZeroLogon Un script Python que utiliza la librería Impacket para probar la vulnerabilidad del exploit Zerologon CVE-2020-1472. Intenta realizar la omisión de autenticación de Netlogon. El script finalizará inmediatamente cuando realice con éxito la omisión, y no realizará...

CVE-2020-1472

CVE-2020-1472 POC Requiere la última versión de impacket desde GitHub con las estructuras netlogon añadidas. Ten en cuenta que, por defecto, esto cambia la contraseña de la cuenta del controlador de dominio. Sí, esto te permite hacer DCSync, pero también rompe la comunicación con otros...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

CVE-2024-49113-Checker

CVE-2024-49113-Checker 用于测试您的环境是否可能受到 CVE-2024-49113（LDAP Nightmare）影响的脚本。该脚本执行以下操作： RPC 连接检查 LDAP 端口测试 Netlogon 服务验证 LDAP 回调验证 root@kitploit: usage : python CVE-2024-49113-checker.py root@kitploit: Example Scan a single IP python CVE-2024-49113-checker.py 192.168.1.1 Scan a subnet python...

CVE-2024-49112

LDAP Nightmare An exploit for CVE-2024-49112 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...