Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...