module

Netlogon Weak Cryptographic Authentication

Try Surface Command
Back to search
Disclosed
N/A
Created
Sep 23, 2020

Description

A vulnerability exists within the Netlogon authentication process where the security properties granted by AES
are lost due to an implementation flaw related to the use of a static initialization vector (IV). An attacker
can leverage this flaw to target an Active Directory Domain Controller and make repeated authentication attempts
using NULL data fields which will succeed every 1 in 256 tries (~0.4%). This module leverages the vulnerability
to reset the machine account password to an empty string, which will then allow the attacker to authenticate as
the machine account. After exploitation, it's important to restore this password to it's original value. Failure
to do so can result in service instability.

Authors

Tom Tervoort
Spencer McIntyre
Dirk-jan Mollema

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/admin/dcerpc/cve_2020_1472_zerologon
    msf auxiliary(cve_2020_1472_zerologon) > show actions
        ...actions...
    msf auxiliary(cve_2020_1472_zerologon) > set ACTION < action-name >
    msf auxiliary(cve_2020_1472_zerologon) > show options
        ...show and set options...
    msf auxiliary(cve_2020_1472_zerologon) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today