ZeroLogon-PoC-DC-Pwn

Zerologon CVE-2020-1472 Overview This project is an implementation of the Zerologon vulnerability CVE-2020-1472 , one of the most critical Active Directory security vulnerabilities. This vulnerability allows an unauthenticated attacker to compromise the entire Active Directory domain by resetting...

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472 - Zero Logon 漏洞 Python 实现 描述 一个使用 Impacket 库测试 CVE-2020-1472 - Zerologon 漏洞的 Python 脚本（感谢 Secura 研究）。 该缺陷源于 Windows 域控制器上使用的 Netlogon 远程协议，该协议用于与用户和机器认证相关的各种任务。 具体来说，问题存在于 Netlogon 会话中 AES-CFB8 加密的使用。AES-CFB8 标准要求明文的每个“字节”都有随机化的初始化向量 IV，以防止攻击者猜测密码。然而，Netlogon 的...

CVE-2020-1472

CVE-2020-1472 Netlogon远程协议调用MS-NRPC权限提升Zerologon 此处描述的攻击利用了一个密码学认证协议不安全地使用了AES-CFB8的缺陷，该协议用于向域控制器DC证明加入域的计算机的真实性和身份。由于错误地使用了一种AES操作模式，攻击者可以伪造任何计算机账户包括DC自身的账户的身份，并在域中为该账户设置空密码只需发送一系列Netlogon消息，其中各个字段填充为零。随后可利用这一点获取域管理员凭据，然后恢复原始的DC密码。 用于检测CVE-2020-1472 git clone...

Low: samba

Issue Overview: No CVE associated with this advisory Affected Packages: samba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update samba or yum update...

Critical: samba

Issue Overview: A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. CVE-2020-14318 A null pointer dereference flaw was fou...

LIVE Webinar on Zerologon Vulnerability: Technical Analysis and Detection

I am sure that many of you have by now heard of a recently disclosed critical Windows server vulnerability—called Zerologon—that could let hackers completely take over enterprise networks. For those unaware, in brief, all supported versions of the Windows Server operating systems are vulnerable t...

Detecting and Preventing Critical ZeroLogon Windows Server Vulnerability

If you're administrating Windows Server, make sure it's up to date with all recent patches issued by Microsoft, especially the one that fixes a recently patched critical vulnerability that could allow unauthenticated attackers to compromise the domain controller. Dubbed 'Zerologon' CVE-2020-1472...

CVE-2020-1472

A flaw was found in the Microsoft Windows Netlogon Remote Protocol MS-NRPC, where it reuses a known, static, zero-value initialization vector IV in AES-CFB8 mode. This flaw allows an unauthenticated attacker to impersonate a domain-joined computer, including a domain controller, and possibly obta...

Exploit for CVE-2020-1472

!Pythonpython-shield CVE-2020-1472 CVE-2020-1472 - Zero...

Microsoft Windows Netlogon Remote Protocol (MS-NRPC) uses insecure AES-CFB8 initialization vector

Overview The Microsoft Windows Netlogon Remote Protocol MS-NRPC reuses a known, static, zero-value initialization vector IV in AES-CFB8 mode. This allows an unauthenticated attacker to impersonate a domain-joined computer, including a domain controller, and potentially obtain domain administrator...