CVE-2020-1472

CVE-2020-1472 Checker & Exploit Code for CVE-2020-1472 aka Zerologon Tests whether a domain controller is vulnerable to the Zerologon attack, if vulnerable, it will resets the Domain Controller's account password to an empty string. NOTE: It will likely break things in production environments eg...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

SecuraBV-CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

redteam-research

Red Team Research Collection of PoC and offensive techniques used by the BlackArrow Red Team License All the code included in this project is licensed under the terms of the MIT license...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit CVE-2020-1472. It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when successfully performing the bypass, and not perform any...

onelogon

Onelogon: Taking over Active Directory Accounts via Netlogon This repository contains code and data accompanying our paper Onelogon: Taking over Active Directory Accounts via Netlogon WOOT'26. 1. Context 2. How to Cite 3. Artifact Structure and Setup 4. Setting Up a Test Environment 5. Scanning f...

CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

zerologon

CVE-2020-1472 aka Zerologon Exploit POC What is it? NetLogon MS-NRPC, can establish inter-domain control vulnerable security channel. It's possible to zero out the password for the machine account on domain controllers. Notes: DC will be semi broken while password is zero'ed out, however this...

CVE-2026-41089-Netlogon-RCE

🚨 CVE-2026-41089: Critical Windows Netlogon RCE Unauthenticated Remote Code Execution on Active Directory Domain Controllers 🧠 Conceptual Overview I am publishing this technical breakdown of CVE-2026-41089 , an exceptionally critical vulnerability residing deep within the Windows Netlogon service...

CVE-2026-41089-Detector

CVE-2026-41089 Detection Tool This is a CVE-2026-41089 detection script for defense audits. The vulnerability is a Windows Netlogon remote code execution vulnerability disclosed by Microsoft in the May 2026 security update. The script does not send exploit packets or attempt to trigger Netlogon...

zerologon-CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC This exploit requires you to use the latest impacket from GitHub. Ensure impacket installation is done with netlogon structures added. Note : 1. By default, successful exploitation changes the password of the DC Account. 2. Allows DCSync 3. Breaks communication with...

dirkjanm-CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHub with added netlogon structures. Do note that by default this changes the password of the domain controller account. Yes this allows you to DCSync, but it also breaks communication with other domain controllers, so be careful with this! Mo...

CVE-2020-1472-LAB

ZeroLogon testing script A lab setup to test a vulnerability for the ZeroLogon exploit CVE-2020-1472. It contains a Python script that uses the Impacket library to test the vulnerability, and a Virtual Machine VM with Windows Server 2019 configured as a Domain Controller DC. The script attempts t...

CVE-2024-49113-Checker

CVE-2024-49113-Checker Script to test whether your environment is potentially vulnerable to CVE-2024-49113 LDAP Nightmare. This script performs: RPC connectivity checks LDAP port tests Netlogon service validation LDAP callback verification root@kitploit: usage : python CVE-2024-49113-checker.py...

CVE-2024-49112

LDAP Nightmare An exploit for CVE-2024-49112 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analyze critical Windows service security vulnerabilities This repository provides tools to analyze and test the Netlogon vulnerability known as CVE-2026-41089. This tool helps security professionals identify if their Windows Domain Controllers face risks from this...

CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

CVE-2020-1472 ZeroLogon Detection and Mitigation Demo This project demonstrates the detection and mitigation of the critical Windows vulnerability CVE-2020-1472, also known as ZeroLogon. The vulnerability allows attackers to gain unauthenticated administrative access. This was developed as part o...