ADZero

Description The vulnerable encryption protocol is implemented instead of the authentication mechanism in the Netlogon protocol. An unauthenticated attacker can use the Zerologon vulnerability to set the computer account password of the Domain Controller machine to null NT hash =...

CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

zerologon

Zerologon test for SMB & RPC A python script based on SecuraBV script. Demonstrates that CVE-2020-1472 can be done via RPC/SMB, and not only over RPC/TCP. Additionaly, there is a random byte in the final client challange & client credential - to test against trivial IDS signatures. The RPC/SMB sc...

cve-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

onelogon

Onelogon: Tomando el control de cuentas de Active Directory mediante Netlogon Este repositorio contiene el código y los datos que acompañan a nuestro artículo Onelogon: Tomando el control de cuentas de Active Directory mediante Netlogon WOOT'26. 1. Contexto 2. Cómo citar 3. Estructura y...

dirkjanm-CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

CVE-2020-1472-Easy

CVE-2020-1472-Easy This is definitely not something you would want to run on anything that you care about. Built from a writeup and work from @obfuscatee and another source Uses code from https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

zerologon-CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC This exploit requires you to use the latest impacket from GitHub. Ensure impacket installation is done with netlogon structures added. Note : 1. By default, successful exploitation changes the password of the DC Account. 2. Allows DCSync 3. Breaks communication with...

zerologon

zerologon Check for events that indicate non compatible devices - CVE-2020-1472 EventID 5827 EventID 5828 EventID 5829 EventID 5830 EventID 5831 In August Microsoft patched CVE-2020-1472. With that patch theres a waiting period until 9th of february 2021 where unsecure connections will be accepte...

Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks.

Simulating-and-preventing-Zerologon-CVE-2020-1472-vulnerability-attacks. Simulation of the Zerologon CVE-2020-1472 vulnerability attack in Active Directory on Windows Server 2016 and the use of the Trend Micro Deep Security solution to prevent such attacks. The Zerologon vulnerability is a weakne...

CVE-2026-41089-Netlogon-RCE-PoC

🛡️ CVE-2026-41089-Netlogon-RCE-PoC - Validate Security Vulnerabilities with Confidence 🔍 What Is This Tool? This is a security research and testing application designed for cybersecurity professionals, IT administrators, and security researchers. It helps you simulate and validate a specific...