ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

zerologon-CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC This exploit requires you to use the latest impacket from GitHub. Ensure impacket installation is done with netlogon structures added. Note : 1. By default, successful exploitation changes the password of the DC Account. 2. Allows DCSync 3. Breaks communication with...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

onelogon

Onelogon: Taking over Active Directory Accounts via Netlogon This repository contains code and data accompanying our paper Onelogon: Taking over Active Directory Accounts via Netlogon WOOT'26. 1. Context 2. How to Cite 3. Artifact Structure and Setup 4. Setting Up a Test Environment 5. Scanning f...

Zerologon_CVE-2020-1472

Zerologon CVE-2020-1472 This script is made for bulk checking your domain controllers for the Zerologon vulnerability. Note Zerologon vulnerabilities are dangerous for your domain controller, dont use the exploit on production servers. Arguments --ip Ip address for check on CVE-2020-1472 --file...

zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

cve-2019-1040-scanner

CVE-2019-1040 scanner Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target hosts and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx. Note...

PIGADVulnScanner

ADVulnScanner Detect common one-shot vulnerabilities in the domain, including: NoPac, ZeroLogon, CVE-2022-26923, PrintNightMare...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

zerologon

Zerologon test for SMB & RPC A python script based on SecuraBV script. Demonstrates that CVE-2020-1472 can be done via RPC/SMB, and not only over RPC/TCP. Additionaly, there is a random byte in the final client challange & client credential - to test against trivial IDS signatures. The RPC/SMB sc...

zerologon

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

cve-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

zer0dump

Zer0Dump Zer0dump is an PoC exploit/tool for abusing the vulnerabilities associated with CVE-2020-1472 Zerologon in order to initiate a full system takeover of an unpatched Windows domain controller. Special thanks to @dirkjanm and @SecureAuthCorp...

Zerologon

Zerologon Exploit Code for CVE-2020-1472 aka Zerologon...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

zerologon-lab

zerologon-lab Scripts for a lab environment demonstrating the Zerologon CVE-2020-1472 vulnerability. Usage zerologon.py zerologon.py -h --reset --restore HEX dcname dcip Attempt to exploit the Zerologon vulnerability against a Domain Controller. Arguments: dcname: The NetBIOS name of the target...

MassZeroLogon

Tool for mass testing ZeroLogon vulnerability CVE-2020-1472 Steps to procedure For using this tool you need a hosts file with the ip adress and hostname separated by comma Hosts file sample 1.1.1.1 , WIN-6641554161U 1.1.1.1 , SERVERDATA 1.1.1.1 , SERVER2012 1.1.1.1 , DC01 1.1.1.1 , SERVER You can...

CVE-2020-1472-Easy

CVE-2020-1472-Easy This is definitely not something you would want to run on anything that you care about. Built from a writeup and work from @obfuscatee and another source Uses code from https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon Project for Course Works NT205.P21.ANTT Cyber-attack Exploit Windows server 2019 vulnerable to Zerologon with Garble, Chisel, Evil-WinRM, Impacket and a vulnerable Wordpress plugin on a Client machine Video demo:...