CVE-2020-1472

Script de prueba de ZeroLogon Un script Python que utiliza la librería Impacket para probar la vulnerabilidad del exploit Zerologon CVE-2020-1472. Intenta realizar la omisión de autenticación de Netlogon. El script finalizará inmediatamente cuando realice con éxito la omisión, y no realizará...

zerologon

zerologon Check for events that indicate non compatible devices - CVE-2020-1472 EventID 5827 EventID 5828 EventID 5829 EventID 5830 EventID 5831 In August Microsoft patched CVE-2020-1472. With that patch theres a waiting period until 9th of february 2021 where unsecure connections will be accepte...

CVE-2020-1472

CVE-2020-1472 arp-scan Rangip nmap -A -vv -Pn IPADDR python3 setemptypw.py DCNETBIOSNAME DCIPADDR python3 secretsdump.py -no-pass -just-dc DOMAIN/DCNETBIOSNAME$@DCIPADDR python3 wmiexec.py -hashes HassPasswdUser DOMAIN/User@dcipaddr comando de Windows whoami systeminfo hostname md testdir echo te...

zerologon

Script de explotación de ZeroLogon Código de explotación basado en https://www.secura.com/blog/zero-logon y https://github.com/SecuraBV/CVE-2020-1472. Investigación y escáner originales por Secura, modificaciones por RiskSense Inc. Para explotar, elimina cualquier instalación previa de Impacket q...

CVE-2020-1472-EXP

Ladon Moudle CVE-2020-1472 Exploit Uso: http://k8gege.org/Ladon/cve-2020-1472.html...

CVE-2020-1472_ZeroLogonChecker

ZeroLogonChecker Comprobador de vulnerabilidades en C para CVE-2020-1472, alias Zerologon...

zerologon

zerologon script zerologon para explotar CVE-2020-1472 CVSS 10/10 Código de explotación basado en https://www.secura.com/blog/zero-logon y https://github.com/SecuraBV/CVE-2020-1472. Investigación original y escáner por Secura, modificaciones por RiskSense Inc. https://github.com/risksense/zerolog...

CVE-2020-1472

CVE-2020-1472 Proceso de reproducción de la vulnerabilidad CVE-2020-1472 Para más detalles del proceso: https://blog.csdn.net/mukami0621/article/details/108605941...

cve-2020-1472_Tool-collection

Artículo de introducción https://www.yuque.com/shamo-vs4ia/vul/ktduf8 Preparación del entorno pip3 install -r requirements.txt Detección de vulnerabilidad python3 zerologontester.py ad adip Explotación python CVE-2020-1472.py AD AD$ adip secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0...

zerologon-poc

zerologon-poc Un script para explotar CVE-2020-1472 Zerologon No es mi investigación. Solo escribí un PoC basado en el brillante trabajo de otros que descubrieron esta vulnerabilidad...

ZeroLogon-CVE-2020-1472-lab

ZeroLogon-CVE-2020-1472 Explicación y demostración de la vulnerabilidad ZeroLogon CVE-2020-1472 El objetivo de este laboratorio es estrictamente educativo. Su ejecución no está recomendada en entornos de producción o que no le pertenezcan. Sobre la Vulnerabilidad Contexto de la vulnerabilidad Est...

Exploit for CVE-2020-1472

ZeroLogon-CVE-2020-1472 Explicação e demonstração da vulnerabi...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

Linux Distros Unpatched Vulnerability : CVE-2020-1472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the...

CVE-2020-1472 affecting package samba for versions less than 4.18.3-1

CVE-2020-1472 affecting package samba for versions less than 4.18.3-1. An upgraded version of the package is available that resolves this issue...

CosmicBeetle Deploys Custom ScRansom Ransomware, Partnering with RansomHub

The threat actor known as CosmicBeetle has debuted a new custom ransomware strain called ScRansom in attacks targeting small- and medium-sized businesses SMBs in Europe, Asia, Africa, and South America, while also likely working as an affiliate for RansomHub. "CosmicBeetle replaced its previously...

Netlogon Weak Cryptographic Authentication

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'windowserror' class MetasploitModule 'Netlogon Weak Cryptographic Authentication', 'Description' = %q A vulnerability exists within the Netlogon authentication...

CISA, FBI, and MS-ISAC Release Advisory on Rhysida Ransomware

Today, the Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC released a joint Cybersecurity Advisory CSA, StopRansomware: Rhysida Ransomware, to disseminate known Rhysida ransomware...

Attacks, Vulnerabilities and Actors 19 June to 25 June 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of twelve attacks executed, taking advantage of seventeen different vulnerabilities ...

Cuba Ransomware Extorted Over $60 Million in Ransom Fees from More than 100 Entities

The threat actors behind Cuba aka COLDDRAW ransomware have received more than $60 million in ransom payments and compromised over 100 entities across the world as of August 2022. In a new advisory shared by the U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of...